ClassroomIO vulnerabilities
CVEs whose affected-version data names the ClassroomIO package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111369High· 7.1ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary …
▾ Twilightclassroomio · ClassroomIOvia CVEORG
CVE-2026-111368Medium· 6.4ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own cour…
▾ Sunlitclassroomio · ClassroomIOvia CVEORG