ClassroomIO through version 1.0.0 has an insecure direct object reference flaw in the Hono API course submission routes. The vulnerability allows a tutor or administrator to supply a target course identifier alongside another course’s submission UUID, enabling PUT or DELETE operations that overwrite answers, grades, feedback, and grading status or delete submissions entirely. This results in tampering with academic records and potentially erasing data, thereby compromising data integrity and the integrity of grading processes.

The affected product is ClassroomIO, version 1.0.0 and earlier. The vulnerability affects any deployment that exposes the V1 Hono API endpoints for course submissions and relies on the default access logic that does not enforce course ownership scoping.

The CVSS score of 6.1 places this defect in the medium severity range, reflecting the need for credentialed users to exploit. The EPSS is < 1% and the vulnerability is not listed in CISA KEV. Attackers who possess tutor or admin credentials (or can spoof them) can exploit the HTTP API endpoints to modify or delete other courses’ submissions. No additional prerequisites are listed; exploitation requires only legitimate API access and appropriate submission identifiers.