CVE-2026-111369: ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-16
Weakness: CWE-863

Description

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

Affected products

ClassroomIO: through 1.0.0

References

https://github.com/classroomio/classroomio
https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/middlewares/course-member.ts
https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/lesson.ts#L107-L152
https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor
https://www.vulncheck.com/advisories/classroomio-through-1.0.0-incorrect-authorization-via-lesson-update-and-delete-routes

Get alerted when CVE-2026-111369 or the next vulnerability affects your stack