Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111368ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes

Medium 6.4

In plain English

A medium-severity authorization bypass via user-controlled key in ClassroomIO from classroomio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.3%top 78.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

Affected products (as reported)

Vendor	Product	Versions
classroomio	ClassroomIO	0 – through 1.0.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

References

https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor third-party-advisory
https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/submission.ts technical-description
https://github.com/classroomio/classroomio/blob/v1.0.0/packages/db/src/queries/submission/submission.ts#L217-L245 technical-description
https://github.com/classroomio/classroomio/commit/1844ad9671a0d9c2566d3431d82f34d39016242c patch
https://github.com/classroomio/classroomio product
VulnCheck Advisory: ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes third-party-advisory