---
cve: "CVE-2026-111369"
severity: "HIGH"
cvss: 7.1
epss: ""
vendor: "classroomio"
kev: false
exploited: false
published: "2026-10-15 22:19:35"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-20T01:31:25+02:00"
---

# CVE-2026-111369

> 7.1 HIGH · 🧪 PoC

## Beschreibung

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-10-16 17:08:02
- CNA-CVSS: **7.1** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-863** — Incorrect Authorization
  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

## Patch verfügbar (OSV)

- e8181b296bdd37de46e2378f2c73c2c1d574331e (Commit)

## Referenzen

- <https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor>
- <https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/lesson.ts#L107-L152>
- <https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/middlewares/course-member.ts>
- <https://github.com/classroomio/classroomio>
- <https://www.vulncheck.com/advisories/classroomio-through-1.0.0-incorrect-authorization-via-lesson-update-and-delete-routes>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-111369/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_