This vulnerability in classroomio 0.1.13 involves an IDOR flaw (CWE-639) where insufficient access control on course ID parameters in URLs enables students with limited privileges to access restricted admin and teacher endpoints. This results in unauthorized disclosure of sensitive information related to courses, administrators, and students. The exposure is momentary before the system restores proper access controls. No known exploits are reported in the wild, and no patch or official fix has been documented.

Unauthorized users (students) can temporarily access sensitive administrative and teacher data by manipulating course ID parameters. This leads to confidentiality breaches of course, admin, and student information. There is no indication of integrity or availability impact. The exposure is transient, as the system reverts to normal access restrictions shortly after the unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected version 0.1.13 and monitor for suspicious URL parameter manipulation. Implement additional access control checks on server-side to validate user permissions for requested resources.