CVE-2025-67259
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged 'student' user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST endpoint results in disclosure of sensitive information including other students' details, tutor/admin profiles, and internal course metadata.
Risk Assessment
A low-privileged user can access other users' data and internal course information, constituting a confidentiality breach that may lead to further attacks.
Recommendation
Update ClassroomIO to a version containing the fix or implement server-side access control for the /rest/v1/course endpoint, verifying user permissions for each request.
Other vulnerabilities in ClassroomIO
See all- CVE-2025-65669Critical
In classroomio 0.1.13, student accounts can delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction.
- CVE-2026-111369High
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson IDs to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.
- CVE-2026-111368Medium
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.
- CVE-2025-65670Medium
An IDOR vulnerability in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in temporary unauthorized disclosure of sensitive course, admin, and student data before the system reverts to normal access restrictions.
- CVE-2025-65672High
An Insecure Direct Object Reference (IDOR) vulnerability in classroomio 0.1.13 allows unauthorized access to share and invite features in course settings.
Original NVD description (English source)
A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST endpoint results in disclosure of sensitive information including other students details, tutor/admin profiles, and internal course metadata.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS