CVE-2026-111368Published
ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111368 · Microsoft / collected KEV context
cve-program · CVE-2026-111368
- https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor
- https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/submission.ts
- https://github.com/classroomio/classroomio/blob/v1.0.0/packages/db/src/queries/submission/submission.ts#L217-L245
- https://github.com/classroomio/classroomio/commit/1844ad9671a0d9c2566d3431d82f34d39016242c
- https://github.com/classroomio/classroomio
- https://www.vulncheck.com/advisories/classroomio-through-1.0.0-idor-via-course-submission-update-grade-and-delete-routes
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.