CVE-2026-124551 — ClassroomIO through 1.0.0: Cross-Organization Course Disclosure via Clone Endpoint

ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone courses belonging to other tenants.