Security readout for executives and security teams
Plain-English summary
A logged-in student may briefly see sensitive classroomio admin, teacher, course, or student information by changing course identifiers in URLs. The interface reportedly returns to a restricted state, but sensitive data may already have reached the browser.
Executive priority
Treat this as a moderate confidentiality issue. Prioritize remediation where classroomio is internet-facing or contains regulated student data, but evidence provided does not support emergency handling for active exploitation.
Technical view
CVE-2025-65670 is a CWE-639 IDOR in classroomio 0.1.13. With low-privileged access, a student can manipulate course IDs to reach admin or teacher endpoints and cause unauthorized disclosure. CVSS 3.1 is 4.3: network reachable, low complexity, low confidentiality impact, no integrity or availability impact.
Likely exposure
Most relevant to organizations running classroomio 0.1.13, especially education portals with student accounts. The CVE metadata lists affected vendor and product as n/a, so exposure should be confirmed through local inventory and upstream project information.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. Exploitation requires an authenticated student-level user and reachable classroomio endpoints. A public researcher reference exists, but this analysis does not rely on or provide exploit steps.
Researcher notes
The key issue is object-level authorization, not UI state. The reported momentary leak matters if restricted data is sent to the client. Source evidence is limited on patch status, affected packaging, and deployment scope.
Mitigation direction
- Check classroomio upstream guidance for patched versions or official mitigation.
- Enforce server-side authorization on every admin, teacher, course, and student data request.
- Ensure course IDs cannot grant access without ownership or role checks.
- Reduce sensitive fields returned to student-facing routes.
- Review logs for unusual cross-course or admin endpoint access by student accounts.
Validation and detection
- Inventory classroomio deployments and confirm whether version 0.1.13 is present.
- Review route handlers for object-level authorization before returning sensitive data.
- Test in authorized staging that student accounts cannot access unrelated course data.
- Verify browser responses do not contain restricted data, even transiently.
- Add regression tests covering student, teacher, and admin role boundaries.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-65670 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N2.81.4CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/classroomio/classroomioCVE reference, mitre
- https://github.com/Rivek619/CVE-2025-65670CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.