CVE-2026-111369— ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes
Quick assessment
Affected
classroomio ClassroomIO
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ClassroomIO 1.0.0 及之前版本存在一个不正确的授权漏洞，涉及 PUT 和 DELETE /:lessonId 课程路线，允许任何课程成员（包括学生）修改课程。经过认证的学生可以随意提供课程ID来更改标题和存储的HTML内容，或删除他们所在课程以及其他课程和组织中的课程。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111369
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes
Source: CVE Program / CVE List V5
Vulnerability Description
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| classroomio | ClassroomIO | 0 ~ 1.0.0 | - |
|
II. Public POCs for CVE-2026-111369
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111369
请登录查看更多情报信息。
Other References for CVE-2026-111369 (4)
-
https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor third-party-advisory
IV. Related Vulnerabilities
Same weakness: CWE-863
-
CVE-2026-111352
ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST -
CVE-2026-111332
OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Sha -
CVE-2026-45165
Idira Secrets Manager (Self-Hosted): Improper Authorization -
CVE-2026-111231
Netgate pfSense CE through 2.9.0 Authorization Bypass via co -
CVE-2026-71490
OPNsense: Direct comma-separated user privileges bypass OPNs
V. Comments for CVE-2026-111369
No comments yet