DeepTutor CVE-2026-51879

Requires that the target runs DeepTutor 1.4.0 with the HTTP tutorbot file route exposed and reachable by the attacker; exploitation then needs only the ability to supply a bot ID (the user-controlled object identifier) to TutorBotManager.write_bot_file. No authentication, user interaction, or non-default configuration is indicated by the CVSS vector (PR:N/UI:N/AC:L). The practical limiting factors are the product's narrow deployment (a niche open-source project rather than enterprise software) and network reachability of the tutorbot endpoint; an attacker must also be able to enumerate or guess valid bot IDs belonging to other users, though SSVC 'Automatable: yes' implies this is straightforward.

Signals conflict sharply here. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.1) plus SSVC (Exploitation: poc, Automatable: yes, Technical Impact: total) and a publicly available exploit gist paint a textbook critical, easily-scriptable IDOR. However, the EPSS score is only 0.15% (4th percentile) and the CVE is NOT on the CISA KEV list, indicating no observed real-world exploitation. This is the classic 'high-CVSS, low-real-world-risk' profile: the flaw is trivially exploitable in principle, but DeepTutor is a niche open-source AI-tutoring research project with a small deployment footprint, so mass exploitation is improbable. The 'Automatable: yes' SSVC value is consistent with the described bot-ID enumeration (a predictable/user-controlled object identifier makes IDOR scripting easy). Note data gaps: the CPE is 'n/a' and EUVD affected version is 'n/a n/a', so the only confirmed affected version is 1.4.0 from the description. Priority should be scaled to whether you actually run DeepTutor - for the vast majority of environments this is low real-world risk despite the critical score; for the few running it, patch promptly since exploit code and automation are both present.

A remote, unauthenticated attacker enumerates sequential or guessable bot IDs and sends a crafted request to the HTTP tutorbot file route, invoking TutorBotManager.write_bot_file against a bot ID they do not own. Because the object identifier is user-controlled and unchecked, they overwrite another bot's whitelisted control files, hijacking that bot's behavior. Public proof-of-concept exploit code exists (a referenced gist), and CVSS AC:L plus SSVC 'Automatable: yes' mean the attack requires no special conditions and is easily scripted at scale.