CVE-2025-65670 Missing authorization in n/a
Students can access sensitive admin and teacher data by manipulating course IDs in URLs, leading to unauthorized information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-65670?
CVE-2025-65670 is a medium-severity missing authorization vulnerability in n/a, published on 26 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts to a normal state restricting access.
Weakness: CWE-639
Which versions are affected by CVE-2025-65670?
It affects 1 product.
Products include Classroomio Classroomio.
How do I fix CVE-2025-65670?
No fix has been published for CVE-2025-65670 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-65670 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65670 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2025-65669 Missing authorization in n/a
- CVE-2025-67298 An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile
- CVE-2025-65672 Missing authorization in n/a
- CVE-2025-65675 Cross-site scripting in n/a
- CVE-2025-65676 Cross-site scripting in n/a
Sources
Also known as GHSA-mh75-3225-9wcj.