EUVD-2025-209575Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST endpoint results in disclosure of sensitive information including other students details, tutor/admin profiles, and internal course metadata.
AnalysisAI
Broken access control in ClassroomIO v0.1.13 allows authenticated low-privileged students to disclose sensitive course information including other students' details, tutor/admin profiles, and internal metadata by modifying API requests from POST to GET against the PostgREST endpoint. The vulnerability requires valid student account credentials but no special privileges, enabling unauthorized horizontal and vertical access escalation within course contexts.
Technical ContextAI
ClassroomIO uses a PostgREST API gateway (/rest/v1/course endpoint) to mediate database access. The vulnerability stems from improper HTTP method validation and insufficient authorization checks at the API layer. PostgREST is a PostgreSQL-to-REST bridge that auto-generates HTTP endpoints from database schema; when configured without proper role-based access controls, it permits unintended data exposure. The issue manifests when POST request constraints (intended for write operations) are bypassed by downgrading to GET requests, which retrieve data without enforcing the same authorization rules. CWE-285 (Improper Authorization) indicates the root cause is missing or incorrect authorization logic that fails to validate whether the authenticated user has permission to access requested resources.
RemediationAI
Implement strict HTTP method-based authorization at the PostgREST API layer by configuring role-based access controls (RLS policies in PostgreSQL) to enforce that GET requests against the /rest/v1/course endpoint respect the same authorization rules as POST requests. Specifically: (1) Upgrade ClassroomIO to a patched version once available from the upstream repository (current patch version not yet confirmed; monitor https://github.com/classroomio/classroomio/releases), (2) In the interim, apply a temporary mitigation by restricting GET access to the /rest/v1/course endpoint to administrative roles only via API gateway rules or reverse proxy configuration (trade-off: may break legitimate student read operations if relying on GET), (3) Audit existing course access logs to identify unauthorized data exposure, (4) Validate PostgREST role-based access control configuration to ensure student roles have view-only or no access to sensitive course metadata fields such as other students' PII and admin/tutor profile data. Detailed advisory available at the GitHub issue linked above.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today