CVE-2026-111368

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

CVSS 4.0

6.1CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

6.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

EPSS

0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-25)

CWE

CWE-639

Published

2026-10-15

Modified

2026-10-16

Record from

the NVD, synced 2026-10-19

References

• https://github.com/classroomio/classroomio
• https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/submission.ts
• https://github.com/classroomio/classroomio/blob/v1.0.0/packages/db/src/queries/submission/submission.ts#L217-L245
• https://github.com/classroomio/classroomio/commit/1844ad9671a0d9c2566d3431d82f34d39016242c
• https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor

Check your stackJSON