Executive brief
ClassroomIO, an open-source education platform, contains a flaw that allows student accounts to delete courses. This action is intended only for administrators, but due to missing security checks, any student can remove entire courses from the platform's Explore page. This could lead to significant loss of educational content and disruption of learning operations.
Technical details
A Broken Access Control vulnerability (CWE-862) exists in ClassroomIO version 0.1.13. The application fails to perform server-side permission validation on the course deletion endpoint exposed via the Explore page. An attacker with a standard student account can trigger the deletion of any published course, bypassing the intended admin-only restriction. The attack is performed over the network with low complexity and requires no special administrative privileges. As of the advisory, the vulnerability is confirmed in version 0.1.13.
Affected products
- classroomio classroomio 0.1.13
Timeline
- 2025-11-26: advisory: CVE-2025-65669 published by NVD/MITRE