EUVD-2026-102508

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE...

CVE-2026-111368

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE...

CVE-2026-111368

The ClassroomIO application (versions through 1.0.0 ) contains an Insecure Direct Object Reference (IDOR) vulnerability within the Hono API course submission routes. The root cause allows authenticated course tutors or admins to access and manipulate data from other courses by providing their own...

CVE-2026-111368 ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE...