CVE-2026-51878
UnknownSummary
Authorization bypass vulnerability in deeptutor 1.4.0 in TurnRuntimeManager.regenerate_last_turn. A remote caller can enumerate or obtain a session_id and trigger regenerate on another user's session.
Risk Assessment
Authorization bypass can lead to unauthorized access to other users' sessions, potentially resulting in privacy breach or data manipulation.
Recommendation
Update deeptutor to a patched version. Additionally, strengthen access control and validate session identifiers.
Other vulnerabilities in deeptutor
See all- CVE-2026-51881Unknown
Code injection vulnerability in deeptutor 1.4.0 in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute chosen shell commands in the service environment.
- CVE-2026-51880Unknown
Path traversal vulnerability in deeptutor 1.4.0 in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace.
- CVE-2026-51879Unknown
Authorization bypass vulnerability in deeptutor 1.4.0 in TutorBotManager.write_bot_file. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route.
- CVE-2026-51876Unknown
Authorization bypass vulnerability in DeepTutor 1.4.0 in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book_id to submit a confirm-proposal request for an existing book, causing unauthorized overwrites of persisted metadata and spine content.
- CVE-2026-51870Critical
DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.
- CVE-2026-58168High
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability allowing low-privilege users to invoke unrestricted MCP tools. The allowed_mcp_tools function returns None instead of a denied result when mcp_tools is omitted from a user's grant.
Original NVD description (English source)
deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate_last_turn. A remote caller can enumerate or obtain a session_id and trigger regenerate on another user's session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS