---
id: "CVE-2026-124551"
page: "https://infrastack.ai/live/CVE-2026-124551"
kind: "vulnerability"
aliases: ["CVE-2026-124551"]
title: "ClassroomIO: any logged-in user can clone other tenants' courses"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["classroomio", "education", "multi-tenant", "other"]
not_affected_if: ["no-shared-organizations", "single-tenant"]
published_at: "2026-11-08T14:18:19+00:00"
first_seen_at: "2026-11-08T14:48:42+00:00"
updated_at: "2026-11-08T14:50:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124551", "first_seen_at": "2026-11-08T14:48:42+00:00"}]
exploit_sources: []
---

# ClassroomIO: any logged-in user can clone other tenants' courses

Link for people: https://infrastack.ai/live/CVE-2026-124551 (this .md is for agents)

ClassroomIO through 1.0.0 lets an authenticated user from one organization clone another organization's course via POST /course/:courseId/clone when they know the course id. The copy includes sections, lessons, exercises and quiz answer keys, exposing private course content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your deployment runs ClassroomIO and which version is installed, `unknown` if the sources do not say which file or command shows it.
- Test whether an account in one organization can call POST /course/:courseId/clone with a course id from another organization, `unknown` for a sanctioned test command.

## Timeline

- 2026-11-08T14:48:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124551

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/classroomio-through-1.0.0-cross-organization-course-disclosure-via-clone-endpoint
- [fix] Patch: github.com https://github.com/classroomio/classroomio/commit/6630b73f8d53e316de6f575a170b093da6bf3cca

## From the sources

ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_