---
id: CVE-2026-111369
title: >-
  ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete
  Routes
summary: >-
  ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in
  the PUT and DELETE /:lessonId lesson routes that allows any course member,
  including students, to modify lessons. Authenticated students can supply
  arbitrary …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-863
vendor: classroomio
product: ClassroomIO
affected:
  - ClassroomIO <= 1.0.0
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:43:52.330Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111369'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor
  - url: >-
      https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/lesson.ts#L107-L152
  - url: >-
      https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/middlewares/course-member.ts
  - url: 'https://github.com/classroomio/classroomio'
  - url: >-
      https://www.vulncheck.com/advisories/classroomio-through-1.0.0-incorrect-authorization-via-lesson-update-and-delete-routes
    label: >-
      VulnCheck Advisory: ClassroomIO through 1.0.0 Incorrect Authorization via
      Lesson Update and Delete Routes
tags:
  - cve.org
ingestedAt: '2026-10-15T22:48:25.460Z'
---

## Overview

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

## Affected

- `ClassroomIO <= 1.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.