CVE-2026-111368

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111368

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111368.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111368

Published

2026-10-15T21:43:51Z

Modified

2026-10-17T02:48:24Z

Severity

6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes

Details

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111368.json"
}

References

Affected packages

Git / github.com/classroomio/classroomio

Affected ranges

Type

GIT

Repo

https://github.com/classroomio/classroomio

Events

Introduced

Fixed

e8181b296bdd37de46e2378f2c73c2c1d574331e

Fixed

1844ad9671a0d9c2566d3431d82f34d39016242c

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.0.0"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.10

v0.1.11

v0.1.12

v0.1.13

v0.3.0

v0.3.1

v0.3.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111368.json"