CVE-2026-51879

Published: Oct 1, 2026Modified: Oct 5, 2026Deferred

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (3)

https://gist.github.com/Ro1ME/ae1933a56ec31eccd2947fa64c1390e1

Source: cve@mitre.org

https://github.com/HKUDS/DeepTutor/issues/516

Source: cve@mitre.org

https://github.com/stitionai/devika/issues/709

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.