MEDIUM 6.0 NVD
CVE-2026-124551
ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via
ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.
References
- https://github.com/classroomio/classroomio
- https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/course.t
- https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/services/course/clone.
- https://github.com/classroomio/classroomio/commit/6630b73f8d53e316de6f575a170b093da6bf3cca
- https://github.com/classroomio/classroomio/issues/1414
This medium severity vulnerability with a CVSS score of 6.0 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.