Incorrect Authorization in ClassroomIO Lesson Management

CVE-2026-111369

What is CVE-2026-111369?

ClassroomIO versions up to 1.0.0 exhibit an incorrect authorization vulnerability that allows authenticated course members, including students, to alter and delete lessons. By exploiting the PUT and DELETE lesson routes, users can inject arbitrary lesson IDs, leading to unauthorized changes in lesson titles and content, as well as the deletion of lessons across their courses and other organizations.

References