DeepTutor: Authorization bypass in TutorBot file management
Summary
The TutorBot file management route in DeepTutor does not check whether the caller is authorized for the bot identified by the bot_id parameter. A remote caller who can reach the HTTP API can enumerate bot IDs and overwrite the whitelisted control files of other bots, such as SOUL.md, which changes their behavior and configuration. The CVE record rates this as critical (CVSS 9.1). The filename whitelist still applies, but no ownership check is performed. Authentication is off by default, so a default installation is reachable by anyone with network access to the port.
Affected
- DeepTutor 1.4.0 (named in the CVE record)
- Vendor and Snyk ranges indicate versions below 1.4.1
Fixed in
- DeepTutor 1.4.1 and later (the vendor release notes list issue #516 as closed)
- Upgrade to the current release, as the vendor's newer releases also contain further fixes
Workaround
- Unknown. No vendor workaround is documented.
- Until the upgrade is done, restrict network access to the DeepTutor port to trusted hosts.
Exploitation
- No evidence of in-the-wild exploitation found. Not confirmed as known exploited.
- CISA SSVC assessment: exploitation PoC, automatable yes, total technical impact.
- A public proof of concept is referenced (gist), but its content was not verified.
- EPSS below 1%.
Our recommendation
- Inventory all DeepTutor instances and their versions.
- Upgrade every instance below 1.4.1 to the current release.
- Until patched, limit access to the DeepTutor port and enable authentication where possible.
- Monitor the file management API for unexpected write requests to bot files.
- Prioritize internet-reachable or shared deployments.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Gist: CVE-2026-51879 (Ro1ME) gist.github.com
- GitHub Issue #516: Cross-Bot Authorization Bypass in TutorBot File Management github.com
- DeepTutor v1.4.1 release notes (mirror) newreleases.io
- Snyk: DeepTutor vulnerability (PyPI) security.snyk.io
- Vulners: SNYK-PYTHON-DEEPTUTOR-21693712 vulners.com
- OpenCVE: CVE-2026-51879 app.opencve.io
- DeepTutor project repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:43.
Original description (NVD)
deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.