CVE-2026-124551

EUVD-2026-119607
ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.3 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
classroomioclassroomio
𝑥
≤ 1.0.0
CNA
Common Weakness Enumeration
References
https://github.com/classroomio/classroomio
https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/course.ts#L584-L612
https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/services/course/clone.ts#L202-L290
https://github.com/classroomio/classroomio/commit/6630b73f8d53e316de6f575a170b093da6bf3cca
https://github.com/classroomio/classroomio/issues/1414
https://hackmd.io/@hieuPenguinnn/classroomio-course-clone-cross-org-content-exfiltration
https://www.vulncheck.com/advisories/classroomio-through-1.0.0-cross-organization-course-disclosure-via-clone-endpoint