CVE-2026-111368: ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with course tutor or administrator privileges can exploit it. The attacker must be able to send requests to the course submission PUT or DELETE API handlers.
What can an attacker change or delete?
By combining a course ID they control with a submission UUID from another course, an attacker can overwrite submission answers, grades, feedback, and grading status. They can also delete the targeted submission.
Which deployments are affected?
ClassroomIO versions through 1.0.0 are affected. The issue is in the Hono API course submission routes.