ClassroomIO up to version 1.0.0 contains an authorization bypass that allows any authenticated user across organizations to clone the course data of another organization by POSTing to /course/:courseId/clone. The attacker can retrieve and copy the full set of sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content. The weakness is classified as CWE‑639, an Authorization Bypass Through User‑Controlled Key.

The affected product is ClassroomIO itself, version 1.0.0. No other product versions were explicitly listed, so the issue applies to all installations running that version or earlier before a fix is released.

The CVSS score is 6, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so while exploitation is demonstrated, widespread commercial use has not been reported. The likely attack vector requires an authenticated user and knowledge of a valid target course ID; once those prerequisites are met, the clone operation can be performed without further authorization checks.