CVE-2025-65669

Critical · CVSS 9.1

classroomio — Missing Authorization (Unauthorized Course Deletion)

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-862

Description

An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction.

Search profile — drives PoC discovery

Symbols Explore pagedelete coursesstudent accountsadmin-only deletioncourse deletion endpointauthorization check

Keywords CVE-2025-65669classroomiounauthorized course deletionmissing authorizationCWE-862student delete courseexplore page bypassclassroomio 0.1.13admin restriction bypassPoC CVE-2025-65669

Versions: 0.1.13

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

Rivek619/CVE-2025-65669 needs review

cited in references

gh_search

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T06:30:39.000Z