{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"classroomio/classroomio","product":"classroomio","source":"CNA: VulnCheck","vendor":"classroomio","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-124551","cwes":["CWE-639"],"description":"ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.","epss":{"date":"2026-11-12","percentile":0.17992,"score":0.00261},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://hackmd.io/@hieuPenguinnn/classroomio-course-clone-cross-org-content-exfiltration"}],"kev":null,"metrics":[{"score":6,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":5.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},{"score":6,"severity":"medium","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":5.3,"severity":"medium","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794493124603,"publishedAt":1794145954322,"references":[{"source":"CNA: VulnCheck","tags":["issue-tracking"],"url":"https://github.com/classroomio/classroomio/issues/1414"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://github.com/classroomio/classroomio"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/classroomio/classroomio/commit/6630b73f8d53e316de6f575a170b093da6bf3cca"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://hackmd.io/@hieuPenguinnn/classroomio-course-clone-cross-org-content-exfiltration"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/course.ts#L584-L612"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/services/course/clone.ts#L202-L290"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/classroomio-through-1.0.0-cross-organization-course-disclosure-via-clone-endpoint"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://hackmd.io/@hieuPenguinnn/classroomio-course-clone-cross-org-content-exfiltration"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/classroomio/classroomio"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/course.ts#L584-L612"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/services/course/clone.ts#L202-L290"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/classroomio/classroomio/commit/6630b73f8d53e316de6f575a170b093da6bf3cca"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/classroomio/classroomio/issues/1414"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://hackmd.io/@hieuPenguinnn/classroomio-course-clone-cross-org-content-exfiltration"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://www.vulncheck.com/advisories/classroomio-through-1.0.0-cross-organization-course-disclosure-via-clone-endpoint"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/classroomio/classroomio/commit/6630b73f8d53e316de6f575a170b093da6bf3cca"}],"revision":"8830c6d7c0a4dfa3f574bec1972e3bc7e07868cec58e6864e0deb3fc52b474d7","sources":[{"modifiedAt":1794493124603,"name":"CNA: VulnCheck","retrievedAt":1794496287889,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124551"},{"modifiedAt":1794147499547,"name":"NVD","retrievedAt":1794161781552,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124551"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794496357270,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-124551"}],"ssvc":{"assessedAt":1794493012655,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpoint","updatedAt":1794496357270}