What is the CVSS score of CVE-2025-67298?

CVE-2025-67298 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Classroomio are affected by CVE-2025-67298?

ClassroomIO versions before 0.2.6 contain a privilege escalation vulnerability that could allow attackers to gain unauthorized administrative access through unauthenticated API endpoints.

How to fix or mitigate CVE-2025-67298?

Within 24 hours: Identify all ClassroomIO deployments and document their versions; implement network-level restrictions to the /api/verify and /rest/v1/profile endpoints using firewall rules or WAF policies. Within 7 days: Monitor access logs for suspicious authentication attempts to these endpoints; restrict API endpoint access to known internal IP ranges only; consider taking the service offline if patching timeline is unclear. Within 30 days: Upgrade all instances to ClassroomIO v0.2.6 or later when available; conduct access reviews to identify any unauthorized privilege changes; implement API authentication and rate limiting controls.

Classroomio CVE-2025-67298

HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-03-11 cve@mitre.org

Authentication Bypass Classroomio

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 15:16 nvd

HIGH 8.1

DescriptionCVE.org

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile

AnalysisAI

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile [CVSS 8.1 HIGH]

Technical ContextAI

Classified as CWE-290 (Authentication Bypass by Spoofing). Affects the the component of ClasroomIO. An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile