CVE-2026-111369 Details

A vulnerability allowing incorrect authorization has been identified in ClassroomIO versions through 1.0.0. This issue resides within the API's course lesson management routes. The vulnerability allows any course member, including students, to modify lessons by exploiting the PUT and DELETE methods on the lesson routes. Authenticated students can manipulate lesson titles, HTML content, or delete lessons by arbitrarily selecting lesson IDs. This exploitation can affect lessons within their own course as well as those in other courses and organizations.

The vulnerability can be addressed by tightening the authorization checks on the lesson routes to ensure that only users with the appropriate roles can modify or delete lessons. This includes implementing cross-course verification to prevent unauthorized actions on lessons from different organizations.