CVE-2026-51876CWE-285

CVE-2026-51876

Critical · published October 2, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
16.3
In the wild
Unconfirmed
What it is

DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book_id to submit a confirm-proposal request for an existing book, causing unauthorized overwrites of persisted metadata and spine content.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00256 · 16.3th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-10-02T02:17Z
References (3)
https://gist.github.com/Ro1ME/c5685936179edcbf942f3fdd745d1473 · [email protected]https://github.com/HKUDS/DeepTutor/issues/514 · [email protected]https://github.com/HKUDS/DeepTutor/issues/514 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 01 OCT 00:00Z
    DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow
    cvelistv5