Threats affecting pkg:github/classroomio

ClassroomIO versions up to 1.0.0 have an authorization bypass vulnerability allowing authenticated users from any organization to clone courses belonging to other tenants. By exploiting the POST /course/:courseId/clone endpoint with a known course ID, attackers can copy sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.