CVE-2026-124551 · Other
NO FIX YET
ClassroomIO through 1.0.0 lets an authenticated user from one organization clone another organization's course via POST /course/:courseId/clone when they know the course id. The copy includes sections, lessons, exercises and quiz answer keys, exposing private course content.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any ClassroomIO deployment through 1.0.0 with more than one organization or tenant is exposed, because the flaw is a missing check that the course belongs to the caller's organization. Single-tenant installs with only one organization have no other tenant's courses to copy. The sources do not state the exact fixed version; the linked patch page is the place to confirm it.
Not affected if no-shared-organizations, single-tenant
Who cares classroomio, education, multi-tenant
unknown if the sources do not say which file or command shows it.unknown for a sanctioned test command.No fix yet, per the sources.
ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.