CVE-2025-65670
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An IDOR vulnerability in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in temporary unauthorized disclosure of sensitive course, admin, and student data before the system reverts to normal access restrictions.
Risk Assessment
The risk involves unauthorized access to administrative and other users' data, potentially compromising system confidentiality and leading to sensitive information leakage.
Recommendation
Immediately update classroomio to the latest patched version and implement authorization checks on all endpoints to prevent ID manipulation.
Other vulnerabilities in classroomio
See all- CVE-2025-65669Critical
In classroomio 0.1.13, student accounts can delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction.
- CVE-2025-65672High
An Insecure Direct Object Reference (IDOR) vulnerability in classroomio 0.1.13 allows unauthorized access to share and invite features in course settings.
Original NVD description (English source)
An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts to a normal state restricting access.