Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-111369: ClassroomIO lets any student edit or delete lessons

CVE-2026-111369 · published 20 days ago

Summary

In ClassroomIO versions up to 1.0.0, the pages used to change or remove a lesson do not properly check who is allowed to do so. A logged‑in student can enter any lesson’s ID and change its title, content, or delete it, even in other courses or organizations. Upgrade to the latest ClassroomIO release or apply the vendor’s fix, and verify that only teachers have permission to modify lessons.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
classroomio	classroomio	<= 1.0.0

Original advisory text

ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

References

https://github.com/classroomio/classroomio Product
https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/middlewares/... Third Party Advisory
https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor Vendor Advisory
https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/cours... Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-1113... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-111369 Vendor Advisory
https://www.vulncheck.com/advisories/classroomio-through-1.0.0-incorrect-authori... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

8.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published15 Oct 2026

Updated4 Nov 2026

First seen15 Oct 2026

Sources

CVE-2026-111369 · NVD

CVE-2026-111369 · MITRE

CVE-2026-111369 · OSV

Track software like this

Free during beta