TI-2026-75099 Aliases CVE-2026-111369

ClassroomIO Incorrect Authorization via Lesson Update and Delete Routes

LOW 31CWE-863Published 2026-10-15 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

ClassroomIO through 1.0.0 contains an incorrect authorization flaw in its lesson PUT and DELETE routes (/:lessonId). Any course member, including students, can modify or delete lessons by supplying arbitrary lesson ids, including lessons in other courses and organizations. The weakness is CWE-863, Incorrect Authorization. An authenticated attacker with low privileges can change lesson titles and stored HTML content or delete lessons, without user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00246 15th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
classroomio	ClassroomIO	up to 1.0.0	—	No fix listed	CNA

ClassroomIO Vendorclassroomio Affected up to 1.0.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for ClassroomIO.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-16 Threatist record created from CVE-2026-111369
2026-10-16 Priority changed: MEDIUM → LOW
2026-10-16 CISA SSVC decision points changed

References

Advisory 1

https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor

Other 3

TI-2025-40417 An issue was discovered in classroomio 0.1.13. CVSS 3.1CRITICAL 9.1
TI-2025-40419 Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share… CVSS 3.1HIGH 7.5
TI-2026-75098 ClassroomIO lets tutors edit submissions in other courses via IDOR CVSS 4.0MEDIUM 6.1
TI-2025-40421 Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows… CVSS 3.1MEDIUM 5.4
TI-2025-40420 Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows… CVSS 3.1MEDIUM 5.4
TI-2025-40418 An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to… CVSS 3.1MEDIUM 4.3

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences