CVE-2026-111369: ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated course member, including a student, can exploit the affected lesson update and delete routes. No user interaction is required.
What access does an attacker need?
The attacker needs a valid authenticated account with course-member access. They can provide arbitrary lesson IDs to target lessons.
Can lessons outside the attacker’s own course be affected?
Yes. The authorization flaw allows modification or deletion of lessons in the attacker’s course as well as in other courses and organizations.
What actions can an attacker perform?
An attacker can change lesson titles and stored HTML content through the PUT route, or delete lessons through the DELETE route.
Which versions are affected?
ClassroomIO through version 1.0.0 is affected.