medium6.4
CVE-2026-111368
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admi…
Impact
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.
Affected products
| Product | Affected versions |
|---|---|
| ClassroomIO | through 1.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/classroomio/classroomio
- https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/submission.ts
- https://github.com/classroomio/classroomio/blob/v1.0.0/packages/db/src/queries/submission/submission.ts#L217-L245
- https://github.com/classroomio/classroomio/commit/1844ad9671a0d9c2566d3431d82f34d39016242c
- https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor
- https://www.vulncheck.com/advisories/classroomio-through-1.0.0-idor-via-course-submission-update-grade-and-delete-routes