EUVD-2026-102509

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delet...

CVE-2026-111369

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delet...

CVE-2026-111369 ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delet...

CVE-2026-111369

Versions of ClassroomIO through 1.0.0 are affected by an incorrect authorization vulnerability (CWE-863) within the PUT and DELETE /:lessonId routes. The root cause allows any authenticated course member, including students , to bypass intended restrictions by supplying arbitrary lesson IDs. This...