CVE-2025-65670
An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts to a normal state restricting access.
Vendor
Product
CWE
Yayın Tarihi
2025-11-26 20:15:49
Güncelleme
2025-12-03 20:51:27
Source Identifier
cve@mitre.org
KEV Date Added
-