Medium severity5.3NVD Advisory· Published Nov 8, 2026· Updated Nov 8, 2026
CVE-2026-124551
CVE-2026-124551
Description
ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.
Affected products
1- Range: <=1.0.0
Patches
Vulnerability mechanics
References
6- github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/course.tsnvd
- github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/services/course/clone.tsnvd
- github.com/classroomio/classroomio/commit/6630b73f8d53e316de6f575a170b093da6bf3ccanvd
- github.com/classroomio/classroomio/issues/1414nvd
- hackmd.io/@hieuPenguinnn/classroomio-course-clone-cross-org-content-exfiltrationnvd
- www.vulncheck.com/advisories/classroomio-through-1.0.0-cross-organization-course-disclosure-via-clone-endpointnvd
News mentions
0No linked articles in our index yet.