Executive brief
ClassroomIO, an open-source education platform used for managing online courses, contains a security flaw that allows unauthorized users to access administrative settings. By manipulating web addresses, a student or unprivileged user can view and modify course sharing and invitation settings that should be restricted to instructors. This could lead to unauthorized individuals being invited to private courses or sensitive course management data being exposed.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in ClassroomIO version 0.1.13 due to improper authorization checks on sensitive course management endpoints. An attacker, typically authenticated as a student or low-privileged user, can bypass intended access controls by directly navigating to specific URLs such as /courses/{course-id}/settings#share and /courses/{course-id}/people?add=true. By supplying a valid course ID, the attacker gains access to the Share and Invite management interfaces, allowing them to manipulate course settings and user invitations. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).
Affected products
- classroomio classroomio 0.1.13
Timeline
- 2025-11-26: disclosed
- 2025-11-26: advisory