---
id: CVE-2026-111369
title: >-
  ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in
  the PUT and DELETE /:lessonId lesson routes that allows any course member,
  including students, to modify lessons
summary: >-
  ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in
  the PUT and DELETE /:lessonId lesson routes that allows any course member,
  including students, to modify lessons. Authenticated students can supply
  arbitrary …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'
cwe:
  - CWE-863
vendor: classroomio
product: ClassroomIO
affected:
  - ClassroomIO <= 1.0.0
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:25:45.343'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111369'
references:
  - url: 'https://github.com/classroomio/classroomio'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/middlewares/course-member.ts
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/lesson.ts#L107-L152
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/classroomio-through-1.0.0-incorrect-authorization-via-lesson-update-and-delete-routes
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00246
epssPercentile: 0.15986
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T16:31:47.802897Z'
ingestedAt: '2026-10-15T22:48:25.460Z'
---

## Overview

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.