rivek619/cve-2025-65670An (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints. Discovered by - Rivek Raj Tamang (RivuDon), Sikkim, India.
An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts to a normal state restricting access.Discovered by - Rivek Raj Tamang (RivuDon), Sikkim, India.
Affected Product: ClassroomIO
Insecure Direct Object Reference / Broken Access Control
This vulnerability allows a student-level user to momentarily access privileged admin-only endpoints by directly manipulating course IDs in the URL. Due to missing authorization checks and improper access validation, sensitive course analytics, attendance records, submissions, people lists, and marks become exposed before the system reverts to enforcing restrictions. This brief but critical information disclosure constitutes an IDOR-based Broken Access Control issue and can lead to leakage of sensitive administrative and student data.
Login as Admin
Create and publish a course with enrolled students.
Access admin endpoints for the course e.g..
courses//analytics, courses//attendance, courses//submissions, courses//people, courses//marks,
Login as Student
Join the course via Explore
Verify Students cannot see admin in the UI
Find the course ID (e.g. by inspecting course lessons URL).
Manually access the admin endpoints by crafting URLs such as:
courses//analytics, courses//attendance, courses//submissions, courses//people, courses//marks,
This vulnerability was discovered and responsibly reported by:
Rivek Raj Tamang (RivuDon) from Sikkim, India
