CVE-2026-111368 | BDVDB-2026-390197 Detail
classroomioClassroomIO
Description#
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact high, availability impact low. Attack vector: network.
Weaknesses#
- CWE-639 Authorization Bypass Through User-Controlled Key
References#
- https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor
- https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/submission.ts
- https://github.com/classroomio/classroomio/blob/v1.0.0/packages/db/src/queries/submission/submission.ts#L217-L245
- https://github.com/classroomio/classroomio/commit/1844ad9671a0d9c2566d3431d82f34d39016242c
- https://github.com/classroomio/classroomio
- https://www.vulncheck.com/advisories/classroomio-through-1.0.0-idor-via-course-submission-update-grade-and-delete-routes
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.