CVE-2026-30368

MediumCVSS 5.4/10Last modified Oct 26, 2026

Description

A client-side authorization flaw in Lightspeed Systems Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
LightspeedLightspeed Classroom5.1.2.1763770643

References

Timeline

Published
Apr 24, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-30378.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote codCVE-2026-30387.5The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockCVE-2026-30397.5BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when recCVE-2026-30407.2A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cCVE-2026-304029.8An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection functionCVE-2026-304037.5There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, wCVE-2026-304047.5The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. This issueCVE-2026-304057.5An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attributeCVE-2026-30412.4A security vulnerability has been detected in xingfuggz BaykeShop up to 1.3.20. Impacted is an unknown function of the file src/baykeshop/coCVE-2026-30429.8A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/indCVE-2026-30436.1A flaw has been found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/navbar.phpCVE-2026-30448.8A vulnerability has been found in Tenda AC8 16.03.34.06. This affects the function webCgiGetUploadFile of the file /cgi-bin/UploadCfg of the
CVE-2026-30368: Medium severity, CVSS 5.4 | Vulnix