CVE-2026-111369CWE-863broken-access-control

CVE-2026-111369

High · published October 16, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00246 · 15.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-16T02:19Z
References (5)
https://github.com/classroomio/classroomio · [email protected]https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/middlewares/course-member.ts · [email protected]https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/lesson.ts#L107-L152 · [email protected]https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor · [email protected]https://www.vulncheck.com/advisories/classroomio-through-1.0.0-incorrect-authorization-via-lesson-update-and-delete-routes · [email protected]
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 15 OCT 21:43Z
    ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes
    cvelistv5
  • 15 OCT 21:43Z
    ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes
    cvelistv5