{"id":"CVE-2026-124551","published":"2026-11-08T14:18:19.417","lastModified":"2026-11-08T14:18:19.547","description":"ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/classroomio/classroomio","tags":[]},{"url":"https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/course.ts#L584-L612","tags":[]},{"url":"https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/services/course/clone.ts#L202-L290","tags":[]},{"url":"https://github.com/classroomio/classroomio/commit/6630b73f8d53e316de6f575a170b093da6bf3cca","tags":[]},{"url":"https://github.com/classroomio/classroomio/issues/1414","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/classroomio-course-clone-cross-org-content-exfiltration","tags":[]},{"url":"https://www.vulncheck.com/advisories/classroomio-through-1.0.0-cross-organization-course-disclosure-via-clone-endpoint","tags":[]}],"exploitRefs":[{"url":"https://github.com/classroomio/classroomio","tags":[]},{"url":"https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/course.ts#L584-L612","tags":[]},{"url":"https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/services/course/clone.ts#L202-L290","tags":[]},{"url":"https://github.com/classroomio/classroomio/commit/6630b73f8d53e316de6f575a170b093da6bf3cca","tags":[]},{"url":"https://github.com/classroomio/classroomio/issues/1414","tags":[]}],"hasPoc":true,"ai":null}