ClassroomIO versions up to 1.0.0 harbor an improper authorization flaw (CWE-863) in the lesson update and delete endpoints. Because any authenticated course member – including students – can supply arbitrary lesson identifiers, an attacker can change lesson titles, alter stored HTML content, or delete lessons. This breach of integrity can mislead learners, distort course material, and result in data loss if lessons are removed from courses or institutions where the attacker is not a legitimate member.

The vulnerable product is ClassroomIO. All released versions up through 1.0.0 are affected; no later releases are listed as having the fix.

The CVSS score of 7.1 signifies a high severity risk. The EPSS score of < 1% indicates a low likelihood of active exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is the authenticated REST API, where a malicious user issues a PUT or DELETE request with a crafted lesson ID. Based on the description, it is inferred that the attacker only needs standard course‑member authentication to perform the exploit, with no elevated privileges required.