Is CVE-2025-65670 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-65670 being exploited in the wild.

How severe is CVE-2025-65670?

Medium severity, with a CVSS score of 4.3, published 26 November 2025.

Is there a fix for CVE-2025-65670?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-65670 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-65670?

Check whether you run Classroomio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65670: classroomio IDOR in admin and teacher endpoints

CVE-2025-65670 · Severity: medium · CVSS 4.3 · Published 2025-11-26

ClassroomIO is an open-source education platform used by companies as an alternative to learning management systems like Moodle. A security flaw allows students to view sensitive administrative information, such as attendance records, student grades, and course analytics, by simply modifying the web address in their browser. This could lead to the unauthorized disclosure of private student data and internal course management details.

Technologies: Classroomio. Vendors: Classroomio.

Quick answers

Is CVE-2025-65670 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-65670 being exploited in the wild.
How severe is CVE-2025-65670?: Medium severity, with a CVSS score of 4.3, published 26 November 2025.
Which products and versions are affected?: Classroomio 0.1.13.
Is there a fix for CVE-2025-65670?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-65670 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-65670?: Check whether you run Classroomio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in classroomio version 0.1.13 due to missing authorization checks on administrative endpoints. A student-level user can bypass intended access controls by manually crafting URLs and substituting course IDs to reach privileged paths such as /analytics, /attendance, /submissions, /people, and /marks. While the system reportedly reverts to a restricted state shortly after the initial request, the flaw allows for the momentary disclosure of sensitive course, admin, and student data. The attack is performed over the network and requires a low-privileged student account but no user interaction.

Affected products

classroomio classroomio 0.1.13

Timeline

2025-11-26: disclosed
2025-11-26: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.