CVE-2025-65670 - An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data

Back Back to CVE browser

MEDIUM

An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data

Published Nov 26, 2025

4.3

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts to a normal state restricting access.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199756
Advisory
https://github.com/Rivek619/CVE-2025-65670
ExploitThird Party Advisory
https://github.com/classroomio/classroomio
Product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199756		Advisory
https://github.com/Rivek619/CVE-2025-65670		ExploitThird Party Advisory
https://github.com/classroomio/classroomio		Product

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Nov 26, 2025

Updated Jul 5, 2026

Reserved Nov 18, 2025

Link CVE-2025-65670

CISA Vulnrichment

Updated Nov 28, 2025

NVD

Status Modified

Modified Jul 5, 2026

Link CVE-2025-65670

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Nov 26, 2025

Updated Jul 5, 2026

Link EUVD-2025-199756

GitHub

No data