CVE-2026-111368 in ClassroomIO
Summary
by MITRE • 10/16/2026
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within ClassroomIO versions up to 1.0.0 represents a critical failure in access control mechanisms, specifically classified as an Insecure Direct Object Reference (IDOR). This flaw resides within the Hono API course submission routes, which are designed to handle the creation, modification, and deletion of student submissions for academic courses. The core technical deficiency lies in the server-side validation logic, which fails to verify that the authenticated user possesses administrative or tutoring privileges over the specific course associated with the submitted data. Instead of binding permissions to the resource owner or the context of the current session, the application relies solely on the identifiers provided by the client side, such as the course ID and submission UUID. This architectural oversight allows any authenticated actor who holds a role like tutor or admin in one course to manipulate resources belonging to entirely different courses simply by altering the parameters sent in HTTP requests.
From an operational perspective, this vulnerability enables severe data integrity violations and unauthorized modifications of academic records. An attacker can exploit the PUT handler to overwrite critical submission details, including student answers, assigned grades, instructor feedback, and the overall grading status. This capability undermines the fundamental trust required for educational platforms, as it allows malicious actors to arbitrarily change outcomes without authorization. Furthermore, the DELETE handler presents an even more destructive risk, permitting the complete removal of submissions from other courses. Such actions can lead to significant academic disruption, loss of evidence regarding student performance, and potential compliance issues related to data retention policies in educational institutions. The ability to modify or delete records across course boundaries indicates a systemic lack of cross-resource authorization checks within the API layer.
This vulnerability aligns closely with CWE-639, which defines Insecure Direct Object Reference as an issue where an application exposes a reference to an internal implementation object, such as a file, directory, or database key, without adequate access control. The exploitation technique maps directly to MITRE ATT&CK tactic TA0005, specifically the Defense Evasion and Impact categories, allowing attackers to manipulate data integrity (T1489) and potentially disrupt operations by deleting critical information (T1485). The attack vector is typically remote via network communication with a privileged account that has been compromised or misused.
Mitigation strategies must focus on implementing robust server-side authorization checks for every API endpoint involved in submission management. Developers should ensure that each request validates not only the user's role but also their specific relationship to the target course and submission. This involves verifying that the authenticated tutor or admin is explicitly assigned to the course identified by the provided ID before processing any modification or deletion requests. Additionally, implementing strict input validation and using indirect object references can further reduce the risk of such exploitation. Regular security audits and penetration testing focused on API logic flaws are recommended to identify similar vulnerabilities in other parts of the application infrastructure.