CVE-2026-111368CWE-639

CVE-2026-111368

Medium · published October 16, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
13.3
In the wild
Unconfirmed
What it is

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
6.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00232 · 13.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-16T02:19Z
References (7)
https://github.com/classroomio/classroomio · [email protected]https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/submission.ts · [email protected]https://github.com/classroomio/classroomio/blob/v1.0.0/packages/db/src/queries/submission/submission.ts#L217-L245 · [email protected]https://github.com/classroomio/classroomio/commit/1844ad9671a0d9c2566d3431d82f34d39016242c · [email protected]https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor · [email protected]https://www.vulncheck.com/advisories/classroomio-through-1.0.0-idor-via-course-submission-update-grade-and-delete-routes · [email protected]https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 15 OCT 21:43Z
    ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes
    cvelistv5
  • 15 OCT 21:43Z
    ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes
    cvelistv5