---
id: CVE-2026-111368
title: >-
  ClassroomIO through 1.0.0 contains an insecure direct object reference
  vulnerability in the Hono API course submission routes that allows course
  tutors or admins to modify submissions in other courses
summary: >-
  ClassroomIO through 1.0.0 contains an insecure direct object reference
  vulnerability in the Hono API course submission routes that allows course
  tutors or admins to modify submissions in other courses. Attackers can supply
  their own cour…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L'
cwe:
  - CWE-639
vendor: classroomio
product: ClassroomIO
affected:
  - ClassroomIO <= 1.0.0
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:25:45.343'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111368'
references:
  - url: 'https://github.com/classroomio/classroomio'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/submission.ts
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/classroomio/classroomio/blob/v1.0.0/packages/db/src/queries/submission/submission.ts#L217-L245
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/classroomio/classroomio/commit/1844ad9671a0d9c2566d3431d82f34d39016242c
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/classroomio-through-1.0.0-idor-via-course-submission-update-grade-and-delete-routes
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00291
epssPercentile: 0.21572
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T14:13:41.959968Z'
ingestedAt: '2026-10-15T22:48:25.460Z'
---

## Overview

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.