Insecure Direct Object Reference in classroomio Affects Student Data Access
CVE-2025-65670
Currently unrated
Key Information:
- Vendor
classroomio
- Status
- Vendor
- CVE Published:
- 26 November 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-65670?
An Insecure Direct Object Reference (IDOR) vulnerability in classroomio version 0.1.13 allows unauthorized access to sensitive endpoints that should only be available to administrators or teachers. By manipulating course IDs within URLs, students can inadvertently access confidential information, including sensitive course content and personal data of administrators and other students. This vulnerability can lead to significant data exposure risk before the system restricts access again.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.