CVE-2026-111369

Received Received - Intake

Incorrect Authorization in ClassroomIO Lesson Routes Allows Unauthorized Modifications

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111369

Affected Vendors & Products

Vendor	Product	Version / Range
classroomio	ClassroomIO	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

ClassroomIO through version 1.0.0 has an authorization flaw in the PUT and DELETE routes for lessons. This allows any authenticated course member, including students, to modify or delete lessons by supplying arbitrary lesson IDs. This affects lessons in their own course as well as lessons in other courses and organizations.

Detection Guidance

This vulnerability can be detected by checking for unauthorized modifications to lessons in ClassroomIO. Look for unexpected changes in lesson titles or content, or missing lessons. Review logs for PUT or DELETE requests to /:lessonId routes from non-admin users. Ensure only authorized users have access to lesson modification endpoints.

Impact Analysis

An attacker with student access could change lesson titles, alter stored HTML content, or delete lessons entirely. This could disrupt course materials, mislead students, or cause data loss across multiple courses and organizations.

Compliance Impact

This vulnerability could lead to unauthorized modification or deletion of sensitive educational data, potentially violating integrity and availability requirements in GDPR and HIPAA. Unauthorized changes to lesson content may also affect data accuracy and accountability.

Mitigation Strategies

Immediately update ClassroomIO to the latest version to patch the authorization flaw. Restrict access to PUT and DELETE /:lessonId routes to admin users only. Audit all lesson modifications and deletions to identify any unauthorized changes. Review user permissions to ensure students cannot modify lessons.

Hi! I’m here to help you understand CVE-2026-111369. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70