This vulnerability (CWE-863) in Lightspeed Classroom v5.1.2.1763770643 involves incorrect authorization on the client side. Attackers can bypass integrity checks and manipulate client-generated authorization tokens without authentication, enabling them to impersonate legitimate users. This flaw compromises the authorization mechanism, allowing unauthorized control and monitoring of student devices through the affected software.

Successful exploitation allows an unauthenticated attacker to impersonate users and gain unauthorized control and monitoring capabilities over student devices managed by Lightspeed Classroom. This could lead to privacy violations and unauthorized surveillance. However, the impact is limited to confidentiality and integrity with no reported availability impact. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected version and applying compensating controls where feasible.