Threats tagged 'ghsa-pf42-vqg2-7vg5'

ClassroomIO versions through 1.0.0 have an authorization bypass vulnerability allowing authenticated users from any organization to clone courses belonging to other tenants. By exploiting the POST /course/:courseId/clone endpoint with knowledge of a target course ID, attackers can copy sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.