DeepTutor: Authorization bypass in book confirmation flow allows overwriting books
Summary
DeepTutor 1.4.0 contains an authorization bypass in the book confirmation flow. An unauthenticated or unauthorized caller who can reuse a publicly exposed book_id can submit a confirm-proposal request for an existing book. The server does not check ownership, so persisted book metadata and spine content can be overwritten. A public proof of concept is referenced and the CVSS score is 9.1 (critical).
Affected
- DeepTutor 1.4.0 (per CVE record)
- Snyk lists all versions below 1.4.1 as affected; not confirmed by the vendor
Fixed in
Unknown. Sources conflict: Snyk points to 1.4.1, while the v1.5.0 release notes list issue #514 as resolved. Use the latest release and check the vendor's release notes.
Workaround
- No vendor workaround documented.
- Enable authentication as described in the project README (effectiveness against this flaw not verified).
- Do not expose the instance directly to the internet; use a VPN or an authenticating reverse proxy.
Exploitation
- Public proof of concept referenced (CISA SSVC: Exploitation poc, Automatable yes, Technical Impact total).
- No known exploitation in the wild. One tracker lists it as not in KEV, but that tracker may be outdated.
- EPSS 0.00324 (low).
Our recommendation
- Identify all DeepTutor instances, including unofficial or test deployments.
- Restrict network access and enable authentication.
- Upgrade to the latest release and verify the fix in the vendor's release notes.
- Check book data for unexpected changes and back up book data.
- Monitor web server logs for confirm-proposal requests from unknown callers.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Issue #514 (HKUDS/DeepTutor) github.com
- Researcher gist: CVE-2026-51876 gist.github.com
- VulDB: CVE-2026-51876 vuldb.com
- OpenCVE: CVE-2026-51876 app.opencve.io
- Snyk: pip vulnerabilities security.snyk.io
- DeepTutor v1.5.0 release notes newreleases.io
- DeepTutor GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:42.
Original description (NVD)
DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book_id to submit a confirm-proposal request for an existing book, causing unauthorized overwrites of persisted metadata and spine content.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.