Cyber Posture

CVE-2025-67298

HighPublic PoC

Published: 11 March 2026

Published
11 March 2026
Modified
07 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 29.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

SI-2 requires identification, reporting, and correction of system flaws like CVE-2025-67298, directly mitigated by patching to ClassroomIO v0.2.6.

AC-3 Access Enforcement good match
prevent

AC-3 enforces approved authorizations at the /api/verify and /rest/v1/profile endpoints, preventing authentication bypass and privilege escalation.

AC-6 Least Privilege good match
prevent

AC-6 applies least privilege to limit the scope and impact of any successful privilege escalation from unauthenticated remote attackers.

Security SummaryAI

CVE-2025-67298 is a privilege escalation vulnerability in ClassroomIO versions before 0.2.6. The flaw resides in the /api/verify and /rest/v1/profile endpoints, enabling a remote attacker to escalate privileges. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWEs 290 (Authentication Bypass), 345 (Insufficient Verification of Data Authenticity), and 639 (Authorization Bypass Through User-Controlled Key).

A remote attacker requires no privileges (PR:N) and can exploit this over the network (AV:N) without user interaction (UI:N), though high attack complexity (AC:H) is needed. Successful exploitation allows privilege escalation with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) in an unchanged scope (S:U).

Mitigation is addressed in ClassroomIO release v0.2.6, available at https://github.com/classroomio/classroomio/releases/tag/v0.2.6. Further technical details, including a proof-of-concept, are provided in the advisory gist at https://gist.github.com/prashunbaral/70c4f6f9d9ff8b82295623073eb41f3a. Security practitioners should prioritize updating affected instances.

Details

CWE(s)
CWE-290CWE-345CWE-639

Affected Products

classroomio
classroomio
≤ 0.2.6

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

CVE enables remote exploitation of public-facing web API endpoints (T1190) with no privileges required, directly facilitating privilege escalation (T1068) via authentication/authorization bypass.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References