CVE-2026-51878CWE-284broken-access-control

CVE-2026-51878

Medium · published October 2, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate_last_turn. A remote caller can enumerate or obtain a session_id and trigger regenerate on another user's session.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00177 · 6.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-10-02T02:17Z
References (4)
https://gist.github.com/Ro1ME/8f6e32ba67d184e64e80f243c6625f3a · [email protected]https://github.com/HKUDS/DeepTutor/issues/515 · [email protected]https://gist.github.com/Ro1ME/8f6e32ba67d184e64e80f243c6625f3a · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/HKUDS/DeepTutor/issues/515 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 01 OCT 00:00Z
    deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate_last_turn
    cvelistv5