CVE-2026-111369

Versions of ClassroomIO through 1.0.0 are affected by an incorrect authorization vulnerability (CWE-863) within the PUT and DELETE /:lessonId routes. The root cause allows any authenticated course member, including students , to bypass intended restrictions by supplying arbitrary lesson IDs. This...