CVE-2025-65670: Medium severity Classroomio classroomio vulnerability

Published Nov 26, 2025

Updated

An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts to a normal state restricting access.

Affected Software

2 affected components

Classroomio classroomio=0.1.13

Event History

Nov 26, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-65670?

CVE-2025-65670 has a medium severity rating due to the potential unauthorized disclosure of sensitive data.

How do I fix CVE-2025-65670?

To fix CVE-2025-65670, ensure that access controls are properly implemented and that course IDs cannot be manipulated to access restricted data.

What systems are affected by CVE-2025-65670?

CVE-2025-65670 affects classroomio version 0.1.13.

What type of vulnerability is CVE-2025-65670?

CVE-2025-65670 is classified as an Insecure Direct Object Reference (IDOR) vulnerability.

What could happen if CVE-2025-65670 is exploited?

Exploitation of CVE-2025-65670 could lead to unauthorized access to sensitive course, admin, and student data.