This vulnerability in ClassroomIO v0.1.13 involves improper access control on the /rest/v1/course API endpoint. Authenticated users with student-level privileges can manipulate intercepted API requests by changing the HTTP method from POST to GET, resulting in unauthorized disclosure of sensitive information related to other users and course metadata. The issue arises from insufficient enforcement of access control policies on this endpoint, allowing privilege escalation through request tampering. No CVSS score or official remediation details have been published.

Exploitation of this vulnerability leads to unauthorized disclosure of sensitive information including other students' personal details, tutor and administrator profiles, and internal course metadata. This can result in privacy violations and potential misuse of exposed data. There is no indication of further impact such as code execution or system compromise from the provided data.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints where possible and monitor for unusual access patterns. Avoid relying on client-side or request method validation alone for access control enforcement.