CVE-2025-67259

A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 affecting the PostgREST endpoint at /rest/v1/course. An authenticated low-privileged student user can access unauthorized course-level information by intercepting and modifying API requests, specifically by changing a captured PO...