The flaw lies in ClassroomIO’s /api/verify and /rest/v1/profile endpoints, which lack proper authorization checks. A remote attacker can craft HTTP requests to these endpoints and obtain administrative privileges, effectively gaining full control of the application. The weakness aligns with CWE‑290 (Missing Authorization) and CWE‑639 (Privilege Escalation).

ClassroomIO applications running any version prior to 0.2.6 are affected. The issue is present in all builds of ClassroomIO before the 0.2.6 release, regardless of deployment environment.

The vulnerability carries a CVSS score of 8.1, indicating high severity. Despite a low EPSS of less than 1 % and no current listing in CISA’s KEV catalog, the potential for remote privilege escalation remains significant. An attacker would need network access to the application’s API layer, which is typically exposed to legitimate users, making exploitation plausible in environments lacking additional network segmentation.