What’s Vulnerable › Vulnerabilities

CVE-2026-111368: ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-15 · updated 2026-10-16
• Weakness: CWE-639

Description

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

Affected products

• ClassroomIO: through 1.0.0

References

• https://github.com/classroomio/classroomio
• https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/submission.ts
• https://github.com/classroomio/classroomio/blob/v1.0.0/packages/db/src/queries/submission/submission.ts#L217-L245
• https://github.com/classroomio/classroomio/commit/1844ad9671a0d9c2566d3431d82f34d39016242c
• https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor
• https://www.vulncheck.com/advisories/classroomio-through-1.0.0-idor-via-course-submission-update-grade-and-delete-routes
• https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor

Get alerted when CVE-2026-111368 or the next vulnerability affects your stack