{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/classroomio/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:classroomio:classroomio:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-111369"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ClassroomIO (\u003c= 1.0.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","authentication-bypass","access-control"],"_cs_type":"advisory","_cs_vendors":["ClassroomIO"],"content_html":"\u003cp\u003eClassroomIO versions through 1.0.0 contain an incorrect authorization vulnerability that allows authenticated users with standard student privileges to perform unauthorized actions on lesson data. The vulnerability resides in the PUT and DELETE HTTP methods for the '/:lessonId' route. Due to insufficient server-side validation of ownership or authorization, an authenticated student can provide an arbitrary 'lessonId' parameter to modify titles, alter HTML content, or permanently delete lessons. This flaw is not limited to the attacker's own course, as the lack of adequate permission checks allows for cross-course and cross-organization impact. This represents a significant risk to data integrity and course availability for institutions relying on the platform.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the ClassroomIO platform with valid student credentials.\u003c/li\u003e\n\u003cli\u003eAttacker intercepts or crafts an HTTP PUT request targeting the /:lessonId endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker modifies the 'lessonId' parameter in the URL path to point to a target lesson outside of their authorized course.\u003c/li\u003e\n\u003cli\u003eAttacker injects malicious or destructive content into the request body (e.g., manipulated HTML or empty strings).\u003c/li\u003e\n\u003cli\u003eThe ClassroomIO server fails to validate if the authenticated user has sufficient permissions for the specified 'lessonId'.\u003c/li\u003e\n\u003cli\u003eThe server processes the request and commits the unauthorized modification to the underlying database.\u003c/li\u003e\n\u003cli\u003eAlternatively, the attacker sends a DELETE request to the /:lessonId endpoint to remove the targeted lesson permanently.\u003c/li\u003e\n\u003cli\u003eFinal objective is the unauthorized alteration or destruction of course curriculum and administrative data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized modification or deletion of lesson content, leading to a complete loss of course integrity and availability. Because the vulnerability allows cross-course and cross-organization impact, a single malicious student account can cause widespread disruption to an entire instance or hosting environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the update or mitigation of affected ClassroomIO instances. Currently, there is no fixed version available; organizations should monitor vendor security communications for patches related to CVE-2026-111369. In the interim, implement strict request filtering on the web application firewall (WAF) to block unauthorized PUT and DELETE methods for the /:lessonId route if they originate from user-level accounts that should not possess administrative privileges.\u003c/p\u003e\n","date_modified":"2026-10-15T22:50:47Z","date_published":"2026-10-15T22:50:47Z","id":"https://feed.craftedsignal.io/briefs/2026-10-classroomio-auth-bypass/","summary":"ClassroomIO versions 1.0.0 and earlier contain an authorization flaw in API routes allowing authenticated students to modify or delete arbitrary lesson content across courses.","title":"Incorrect Authorization in ClassroomIO Lesson Routes","url":"https://feed.craftedsignal.io/briefs/2026-10-classroomio-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - ClassroomIO","version":"https://jsonfeed.org/version/1.1"}