CVE-2026-111369

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111369
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111369.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111369
Published
2026-10-15T21:43:52Z
Modified
2026-10-17T02:48:24Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes
Details

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111369.json"
}
References

Affected packages

Git / github.com/classroomio/classroomio

Affected ranges

Type
GIT
Repo
https://github.com/classroomio/classroomio
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e8181b296bdd37de46e2378f2c73c2c1d574331e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.0.0"
        },
        {
            "fixed":  "1.0.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.10
v0.1.11
v0.1.12
v0.1.13
v0.3.0
v0.3.1
v0.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111369.json"