CVE-2026-111368: ClassroomIO 0 through 1.0.0

Affected technology

ClassroomIO · 0 through 1.0.0
classroomio

Description’s affected range: through 1.0.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions. Vendor/CNA’s CVSS 4.0 assessment (base score 6.1/10) rates confidentiality and availability impact as low; integrity impact as high.