In classroomio version 0.1.13, a lack of proper authorization and authentication checks on the course deletion functionality allows student accounts to delete courses from the Explore page. This vulnerability violates the expected admin-only deletion restriction, enabling unauthorized users to perform high-impact actions. The CVSS 3.1 base score is 9.1, reflecting network attack vector, no privileges required, no user interaction, and high impact on integrity and availability. No patch or remediation information is currently available.

The vulnerability allows any student user to delete courses without authorization, leading to unauthorized modification and removal of course data. This impacts the integrity and availability of the system's course information, potentially disrupting educational activities and data consistency.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected version 0.1.13 or implement additional access controls at the application or network level to prevent unauthorized course deletions by student accounts.