Authorization Bypass in ClassroomIO Allows Course Cloning by Authenticated Users

CVE-2026-124551

What is CVE-2026-124551?

ClassroomIO versions up to 1.0.0 are susceptible to an authorization bypass vulnerability that enables an authenticated user to clone courses from other tenants. By targeting the POST /course/:courseId/clone endpoint, attackers with knowledge of a specific course ID can replicate an organization’s sections, lessons, exercises, and quiz answer keys into their own account. This flaw poses a significant risk of exposing confidential learning materials and course content to unauthorized users, highlighting the importance of robust access control measures.

References