The vulnerability is a broken access control in ClassroomIO v0.1.13 that allows any authenticated low‑privileged student to read other students’ personal information, tutor and admin profiles, as well as internal course metadata. By changing a captured POST request to a GET request against the /rest/v1/course PostgREST endpoint, an attacker can retrieve sensitive data that should be protected. This indicates an unauthorized disclosure of private information, a classic broken access control problem (CWE‑284 and CWE‑285).

ClassroomIO version 0.1.13 on all deployments is affected. No other versions were identified in the current advisory.

The CVSS base score of 6.5 indicates a medium severity with significant confidentiality impact. The EPSS score is reported as less than 1 %, implying a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. However, an attacker only needs to be authenticated as a student, intercept the network traffic, and modify the HTTP method – a straightforward technique that can be performed over an unsecured network or via a browser developer console. Consequently, the risk is moderate but should not be ignored, especially in environments where sensitive student or instructor data is stored.