CVE-2025-65669 Missing authorization in n/a
Students can delete courses without authorization, allowing unauthorized data modification in classroomio.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-65669?
CVE-2025-65669 is a critical missing authorization vulnerability in n/a, published on 26 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction.
Weakness: CWE-862
Which versions are affected by CVE-2025-65669?
It affects 1 product.
Products include Classroomio Classroomio.
How do I fix CVE-2025-65669?
No fix has been published for CVE-2025-65669 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-65669 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65669 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2025-67298 An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile
- CVE-2025-65672 Missing authorization in n/a
- CVE-2025-65675 Cross-site scripting in n/a
- CVE-2025-65676 Cross-site scripting in n/a
- CVE-2025-65670 Missing authorization in n/a
Sources
Also known as GHSA-43w2-q5cj-hwmq.