Insecure Direct Object Reference in ClassroomIO Hono API
CVE-2026-111368

6.1MEDIUM

Key Information:

Vendor

Classroomio

Status
Classroomio
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111368?

ClassroomIO version 1.0.0 contains an insecure direct object reference vulnerability in its Hono API related to course submission routes. This flaw enables course tutors or administrators to adversely affect submissions across different courses. By manipulating course IDs linked to submission UUIDs via PUT or DELETE methods, assailants can potentially overwrite answers, grades, feedback, and the overall grading status, or they can erase submissions altogether. This weakness poses a significant risk, allowing unauthorized modifications and deletions of academic records.

Affected Version(s)

ClassroomIO 0 <= 1.0.0

References

https://hackmd.io/@hieuPenguinnn/classroomio-course-resou...
third-party-advisory
https://github.com/classroomio/classroomio/blob/v1.0.0/ap...
technical-description
https://github.com/classroomio/classroomio/blob/v1.0.0/pa...
technical-description

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.