CVE-2025-67298: High severity npm/ClassroomIO vulnerability

Q: Which deployments are affected?

ClassroomIO versions before 0.2.6 are affected. The issue is described for the npm/ClassroomIO and Classroomio classroomio software entries.

Q: Does exploitation require authentication or user interaction?

No. The CVSS vector indicates that the vulnerability is remotely reachable over the network, requires no privileges, and requires no user interaction.

Q: What access does an attacker need to target?

An attacker needs network access to the affected ClassroomIO service and its /api/verify and /rest/v1/profile endpoints. The reported impact is privilege escalation with high confidentiality, integrity, and availability impact.

Q: What version should be deployed to remediate the issue?

Upgrade ClassroomIO to version 0.2.6 or later. The vulnerability affects versions before 0.2.6.

Published Mar 11, 2026

Updated

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile

Affected Software

2 affected components

npm/ClassroomIO<0.2.6

Classroomio classroomio<0.2.6

Event History

Mar 11, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are affected?

ClassroomIO versions before 0.2.6 are affected. The issue is described for the npm/ClassroomIO and Classroomio classroomio software entries.

Does exploitation require authentication or user interaction?

No. The CVSS vector indicates that the vulnerability is remotely reachable over the network, requires no privileges, and requires no user interaction.

What access does an attacker need to target?

An attacker needs network access to the affected ClassroomIO service and its /api/verify and /rest/v1/profile endpoints. The reported impact is privilege escalation with high confidentiality, integrity, and availability impact.

What version should be deployed to remediate the issue?

Upgrade ClassroomIO to version 0.2.6 or later. The vulnerability affects versions before 0.2.6.

CVE-2025-67298: High severity npm/ClassroomIO vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What access does an attacker need to target?

What version should be deployed to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What access does an attacker need to target?

What version should be deployed to remediate the issue?