CVE-2025-67259: n/a
CVE-2025-67259 is a Broken Access Control vulnerability in ClassroomIO v0. 1. 13 that allows an authenticated low-privileged student user to access unauthorized course-level information. By modifying intercepted API requests from POST to GET against the /rest/v1/course PostgREST endpoint, the attacker can retrieve sensitive data including other students' details, tutor and admin profiles, and internal course metadata. The vulnerability has a CVSS score of 6. 5, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
AI Analysis
Technical Summary
This vulnerability in ClassroomIO v0.1.13 involves improper access control enforcement on the /rest/v1/course API endpoint. An authenticated user with student-level privileges can manipulate API requests to escalate access and retrieve sensitive information not intended for their role. The issue stems from the ability to change a POST request to a GET request, bypassing authorization checks and exposing confidential data related to other users and course metadata. The vulnerability is categorized under CWE-284 (Improper Access Control) and CWE-285 (Improper Authorization).
Potential Impact
Successful exploitation results in unauthorized disclosure of sensitive information including details of other students, tutor and administrator profiles, and internal course metadata. This exposure can lead to privacy violations and potential misuse of personal and administrative data. There is no indication of impact on system integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint where possible and monitor for suspicious activity involving API request manipulation. Avoid relying solely on client-side controls for access enforcement.
CVE-2025-67259: n/a
Description
CVE-2025-67259 is a Broken Access Control vulnerability in ClassroomIO v0. 1. 13 that allows an authenticated low-privileged student user to access unauthorized course-level information. By modifying intercepted API requests from POST to GET against the /rest/v1/course PostgREST endpoint, the attacker can retrieve sensitive data including other students' details, tutor and admin profiles, and internal course metadata. The vulnerability has a CVSS score of 6. 5, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVSS v3.1
Score 6.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in ClassroomIO v0.1.13 involves improper access control enforcement on the /rest/v1/course API endpoint. An authenticated user with student-level privileges can manipulate API requests to escalate access and retrieve sensitive information not intended for their role. The issue stems from the ability to change a POST request to a GET request, bypassing authorization checks and exposing confidential data related to other users and course metadata. The vulnerability is categorized under CWE-284 (Improper Access Control) and CWE-285 (Improper Authorization).
Potential Impact
Successful exploitation results in unauthorized disclosure of sensitive information including details of other students, tutor and administrator profiles, and internal course metadata. This exposure can lead to privacy violations and potential misuse of personal and administrative data. There is no indication of impact on system integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint where possible and monitor for suspicious activity involving API request manipulation. Avoid relying solely on client-side controls for access enforcement.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2025-12-08T00:00:00.000Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69eb9c3d87115cfb684e032b
Added to database: 4/24/2026, 4:37:17 PM
Last enriched: 5/1/2026, 8:45:26 PM
Last updated: 6/7/2026, 12:57:04 PM
Views: 73
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.