ClassroomIO EUVD-2026-102509

Requires an authenticated ClassroomIO account that is a member of at least one course (PR:L) - a standard enrolled student suffices; no instructor, admin, or elevated role is needed. The specific trigger is the PUT and DELETE handlers on the lesson route /:lessonId, where the course-member middleware verifies that the caller is a member but fails to verify that the supplied lessonId actually belongs to the caller's course, allowing arbitrary lesson IDs to be targeted. Exploitation works against default deployments of ClassroomIO up to and including v1.0.0 with no special configuration. The only limiting factors are possession of a valid course-member session and knowledge or enumeration of target lesson IDs; there is no required user interaction, no admin privilege, and no non-default setting needed.

This is a genuine but bounded-priority issue rather than a top-tier emergency. The CVSS 4.0 score of 7.1 (HIGH) is driven almost entirely by VI:H (high integrity impact) with AV:N/AC:L/PR:L/UI:N: a low-privileged, authenticated student can remotely and reliably tamper with lesson content with no user interaction. Crucially, confidentiality impact is N and availability is only L, so despite being 'HIGH' this is an integrity/data-tampering flaw, not a code-execution or data-breach flaw. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so there is no evidence of active exploitation or automated weaponization; exploitation probability signals are simply absent rather than low. A detailed third-party technical write-up (hackmd) and VulnCheck/GitHub source-line references exist, which materially lowers the bar for a motivated attacker to reproduce the bug even though no packaged exploit is confirmed. The PR:L requirement is the main mitigating factor - the attacker must already be an authenticated course member (e.g., an enrolled student) - but the cross-course/cross-organization scope of the impact meaningfully amplifies the blast radius beyond a single tenant. Net: real and worth patching promptly for anyone running ClassroomIO, but the low real-world deployment footprint and the requirement for an authenticated account keep it well below critical-priority emergency status.

An attacker registers for or is enrolled in any single course on a ClassroomIO instance, obtaining a normal authenticated student session. They then enumerate or guess lesson IDs and issue PUT/DELETE requests to /:lessonId for lessons belonging to other courses and even other organizations, rewriting lesson titles and stored HTML (enabling content defacement or stored-XSS-style payloads) or deleting lessons outright. Given AV:N/AC:L/PR:L/UI:N and a public technical write-up of the flaw, reproduction is low-effort, though no packaged exploit is confirmed in the provided data.