CVE-2026-111368

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.4 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
classroomioclassroomio
𝑥
≤ 1.0.0
CNA
Common Weakness Enumeration
References
https://github.com/classroomio/classroomio
https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/submission.ts
https://github.com/classroomio/classroomio/blob/v1.0.0/packages/db/src/queries/submission/submission.ts#L217-L245
https://github.com/classroomio/classroomio/commit/1844ad9671a0d9c2566d3431d82f34d39016242c
https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor
https://www.vulncheck.com/advisories/classroomio-through-1.0.0-idor-via-course-submission-update-grade-and-delete-routes