Listen to this Post
How the mentioned CVE works:
In classroomio version 0.1.13, the Explore page displays courses for students. The application intended to restrict course deletion to administrators only. However, a critical authorization flaw exists. Student accounts can trigger delete actions on the Explore page. The server-side code processes deletion requests without verifying user roles. Specifically, the endpoint handling course deletions bypasses admin checks. When a student sends a DELETE request, the server fails to validate permissions. This occurs due to missing access control lists (ACL) on the deletion function. The vulnerability allows any authenticated student to delete courses. No additional authentication checks are performed. The issue stems from incomplete implementation of role-based access control. The Explore page UI may expose delete buttons to all users. The backend does not enforce isAdmin() verification before deletion. Attackers exploit this by crafting direct HTTP requests. A valid student session token is sufficient. This flaw leads to unauthorized data manipulation. It compromises course integrity and platform security. The vulnerability is critical as it enables data destruction by low-privilege users. Fix requires adding proper authorization checks in the code.
Platform: classroomio
Version: 0.1.13
Vulnerability: unauthorized course deletion
Severity: critical
Date: 11/26/2025
Prediction: Patch Dec 2025
What Undercode Say:
bash: curl -X DELETE $TARGET/courses/$ID -b session_cookie
code: if not user.is_admin: raise PermissionError
bash: grep -r “deleteCourse” src/
code: def delete_course(): missing auth check
How Exploit:
Student sends DELETE request.
Use browser dev tools.
Exploit via crafted API call.
Protection from this CVE
Update software version.
Implement role checks.
Audit access controls.
Impact:
Course data loss.
Platform disruption.
Trust compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
