Broken Access Control in ClassroomIO Affects Student User Access
CVE-2025-67259

6.5MEDIUM

Key Information:

Vendor

ClassroomIO

Status
ClassroomIO
Vendor
CVE Published:
24 April 2026

What is CVE-2025-67259?

ClassroomIO v0.1.13 contains a vulnerability that allows authenticated low-privileged 'student' users to exploit broken access controls. This occurs when users modify intercepted API requests, specifically changing a POST request into a GET request directed at the /rest/v1/course PostgREST endpoint. This manipulation results in unauthorized disclosure of sensitive information, including details of other students, profiles of tutors and administrators, and internal course metadata, posing a significant risk to user privacy and system integrity.

References

https://drive.google.com/file/d/1G_IjEURNBcaSmBo4FdOo_27q...
https://github.com/classroomio/classroomio/issues/642

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.