An issue in ClassroomIO before version 0.2.6 allows a remote attacker to elevate privileges by exploiting the exposed API endpoints /api/verify and /rest/v1/profile. The vulnerability is caused by weaknesses in authorization handling (CWE 290 for improper authorization, CWE 345 for insecure random number usage, and CWE 639 for missing access control checks). The impact is that an attacker can obtain higher‑level permissions than intended, potentially gaining full control over the application or sensitive data.

All releases of ClassroomIO older than 0.2.6 are affected. The fix was introduced in the 0.2.6 release, and no other vendor or product details are provided.

The CVSS score of 8.1 classifies this vulnerability as High severity. The EPSS score is below 1%, indicating a low likelihood of exploitation in the wild at present, and it is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be remote over HTTP without requiring local access; an unauthenticated attacker can trigger the privilege escalation by sending requests to the vulnerable endpoints.