CVE-2025-65672 Missing authorization in n/a
An attacker can access and modify course settings without authorization due to an Insecure Direct Object Reference vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-65672?
CVE-2025-65672 is a high-severity missing authorization vulnerability in n/a, published on 26 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.
Weakness: CWE-639
Which versions are affected by CVE-2025-65672?
It affects 1 product.
Products include Classroomio Classroomio.
How do I fix CVE-2025-65672?
No fix has been published for CVE-2025-65672 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-65672 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65672 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2025-65669 Missing authorization in n/a
- CVE-2025-67298 An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile
- CVE-2025-65675 Cross-site scripting in n/a
- CVE-2025-65676 Cross-site scripting in n/a
- CVE-2025-65670 Missing authorization in n/a
Sources
Also known as GHSA-px6j-wc84-gwhf.