ClassroomIO EUVD-2026-102508

Exploitation requires (1) an authenticated account already holding tutor or admin privileges in at least one course (PR:L), and (2) knowledge of a target submission's UUID belonging to a DIFFERENT course (AT:P), because the vulnerable Hono API PUT/DELETE submission handlers in ClassroomIO through 1.0.0 trust the attacker-supplied course id and fail to verify that the referenced submission UUID actually belongs to that course. Limiting factors that reduce realistic risk: the attacker must already be a privileged course staff member, and submission UUIDs are random and non-enumerable, so cross-course targeting depends on obtaining a specific victim UUID rather than guessing it; there is no unauthenticated or anonymous path and no user interaction from the victim is needed.

This is a medium-severity authorization flaw (CVSS 4.0 base 6.1) whose real-world risk is bounded by its preconditions rather than by raw reach. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) shows a network-reachable API bug that nonetheless requires an authenticated actor holding at least tutor or admin privileges (PR:L) and an attack requirement (AT:P) - namely possession of another course's submission UUID, which is a random, non-enumerable identifier. Impact is weighted toward integrity (VI:H): an attacker can overwrite answers, grades, feedback, and grading status, or delete submissions, with only limited confidentiality (VC:L) and limited availability (VA:L) effect and no scope change (SC/SI/SA:N). No EPSS score, KEV listing, or weaponized public exploit was provided in the intelligence, so there is no evidence of active or widespread exploitation; a public technical writeup (hackmd) and the vendor patch commit exist, which raises reproducibility but does not equal in-the-wild use. Net assessment: this is a legitimate insider/privilege-abuse and multi-tenant data-integrity concern for organizations running multiple courses on ClassroomIO, but it is NOT a drive-by, unauthenticated, mass-exploitation priority - it should be patched on a normal schedule, prioritized higher where tutor/admin accounts are loosely provisioned.

A user who legitimately holds a tutor or admin role in one ClassroomIO course obtains the UUID of a submission belonging to a different course (via leakage, shared tooling, or prior access). They send a PUT or DELETE request to the Hono API submission route supplying their OWN course id together with the victim course's submission UUID; because the handler trusts the user-controlled course id instead of verifying the submission actually belongs to it, the attacker overwrites grades/feedback or deletes the submission. A detailed public writeup describing the flaw exists, but no weaponized exploit was reported in the provided data.