ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111369 · Microsoft / collected KEV context

cve-program · CVE-2026-111369

• https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor
• https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/lesson.ts#L107-L152
• https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/middlewares/course-member.ts
• https://github.com/classroomio/classroomio
• https://www.vulncheck.com/advisories/classroomio-through-1.0.0-incorrect-authorization-via-lesson-update-and-delete-routes

No related operational record is retained in the current change model.