CVE-2026-111368

Received Received - Intake

Insecure Direct Object Reference in ClassroomIO Course Submission API

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111368

Affected Vendors & Products

Vendor	Product	Version / Range
classroomio	ClassroomIO	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

ClassroomIO through 1.0.0 has an insecure direct object reference vulnerability in its Hono API course submission routes. This allows authenticated course tutors or admins to modify or delete submissions in courses they do not have access to by supplying a different course ID with a valid submission UUID.

Impact Analysis

Attackers with tutor or admin privileges could overwrite grades, feedback, or grading status of submissions in other courses. They could also delete submissions entirely, potentially altering academic records or causing data loss.

Compliance Impact

This vulnerability could lead to unauthorized modification or deletion of sensitive data, violating integrity and confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to unauthorized access and data tampering.

Mitigation Strategies

Update ClassroomIO to the latest version beyond 1.0.0 to address the insecure direct object reference vulnerability. Review and restrict access to PUT and DELETE handlers for course submissions to ensure only authorized users can modify or delete submissions within their own courses.

Hi! I’m here to help you understand CVE-2026-111368. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70