EUVD-2026-91128
GHSA-h434-cpxm-mqxr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover public book_id
-
ExploitCraft confirm-proposal request
-
ExecutionBypass authorization check
-
ImpactOverwrite persisted metadata and spine
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a reachable DeepTutor 1.4.0 instance exposing the book confirmation endpoint, and (2) knowledge of a valid, existing book_id - which the advisory states is 'publicly exposed,' so it is readily obtainable rather than a secret. No authentication, no privileges, and no user interaction are required (PR:N/UI:N), and default configurations appear vulnerable. The practical limiting factors are narrow: the attacker must target an actual DeepTutor 1.4.0 deployment and reference an existing book, and impact is confined to overwriting that book's metadata and spine content rather than full system compromise. |
| Impact | Signals conflict sharply. The input CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable, unauthenticated network attack, which on its own screams high priority. However, EPSS is only 0.15% (4th percentile), indicating very low modeled exploitation probability in the wild, and there is no CISA KEV listing - so this is not confirmed active exploitation. A gist and a GitHub issue are referenced, suggesting publicly available exploit/proof-of-concept code likely exists, but that is distinct from active exploitation. The dominant mitigating factor is prevalence: DeepTutor (HKUDS) is a niche open-source academic/research project, not enterprise-ubiquitous software, which explains the low EPSS despite the high base score. I also dispute the confidentiality rating: the description details 'unauthorized overwrites of persisted metadata and spine content' - a clear integrity impact - and the abused book_id is 'publicly exposed,' so there is no obvious confidentiality breach; the input C:H appears overstated and I assess C:N (see assessed vector). Net: genuine, easy-to-trigger authorization flaw (CWE-285) that is a real priority for anyone running DeepTutor 1.4.0, but a low systemic threat given the tiny deployment footprint and absence of evidence of widespread exploitation. |
| Exploit ScenarioDerived | An attacker enumerates or observes a publicly exposed book_id in a DeepTutor 1.4.0 instance, then sends a crafted confirm-proposal request for that existing book without authenticating. Because the confirmation flow does not verify the caller's authorization, the request succeeds and silently overwrites the book's persisted metadata and spine content. Public proof-of-concept material is likely available via the referenced gist, lowering the skill barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthorized overwrites of persisted book metadata and spine content are possible in DeepTutor 1.4.0 because the book confirmation flow does not verify that the caller is authorized to act on the referenced book. An attacker who knows a valid, publicly exposed book_id can submit a confirm-proposal request remotely over the network to modify an existing book's stored metadata and spine, with no authentication, privileges, or user interaction required per the assessed vector (AV:N/AC:L/PR:N/UI:N). Impact is integrity-only per the assessed analysis (C:N/I:H/A:N), meaning data modification rather than data disclosure or system compromise; EPSS is low at 0.15% (4th percentile), no CISA KEV listing is present, and no public exploit code has been identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must currently rely on compensating controls; monitor the upstream project issue (https://github.com/HKUDS/DeepTutor/issues/514) and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-51876) for a fixed release and upgrade immediately once a patched version is published. Until then, the most effective control is to place the book confirmation endpoint behind an authenticated reverse proxy or API gateway that enforces a session-to-book ownership check before proxying the request, which blocks the unauthenticated path but requires you to define who legitimately confirms proposals. Alternatively, restrict the endpoint at the network layer by allowlisting only trusted operator IP ranges or requiring mutual TLS, accepting that this breaks any legitimate external or mobile confirmation clients. If ownership data is available, apply a server-side patch or middleware validation comparing the authenticated principal against the target book's owner and rejecting confirm-proposal requests that reference books the caller does not own; this is the closest substitute for the missing vendor fix but must be re-applied after upgrades. Treat book_id as a bearer secret rather than a public identifier by regenerating identifiers for existing books and avoiding their exposure in public pages, client-side code, or logs, though regeneration will invalidate any stored links or integrations that reference the old identifiers. Finally, enable write-ahead logging or snapshotting of book metadata and spine storage and alert on unexpected confirm-proposal writes so that unauthorized overwrites can be detected and reverted, since detection does not prevent the overwrite but limits its persistence.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a server-side authorization failure (CWE-285, Improper Authorization) in DeepTutor's book confirmation workflow. DeepTutor, maintained under the HKUDS GitHub organization, exposes a confirmation endpoint that accepts a confirm-proposal request keyed by a book_id. The root cause is that the endpoint trusts the caller-supplied book_id as sufficient context and performs no check that the requester owns, administers, or is otherwise entitled to modify that book; the book_id functions as an identifier rather than an access secret, and the advisory characterizes it as publicly exposed. As a result, an object-reference style request against an existing book is processed and the attacker-controlled proposal is persisted, altering stored metadata and spine content. The technology involved is a network-accessible application endpoint performing state-changing writes without an authorization gate; the assessed vector scopes consequences to integrity (I:H) with no confidentiality or availability impact (C:N/A:N), while the originally published CVSS 9.1 vector also assigned C:H. No authoritative CPE string was supplied by the upstream feed (recorded as cpe:2.3:a:n/a:n/a), so affected-product identification rests on the vendor/project name and the 1.4.0 version drawn from the description and ENISA EUVD record EUVD-2026-91128.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated remote request over the network with no interaction (AV:N/AC:L/PR:N/UI:N); impact is unauthorized data overwrite so I:H, but no confidentiality or availability loss (C:N/A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book_id to submit a confirm-proposal request for an existing book, causing unauthorized overwrites of persisted metadata and spine content.
Executive ViewAI
For organizations relying on DeepTutor 1.4.0 to deliver or manage book-based learning content, there is a critical risk that stored catalog records and book structure can be changed without authorization. Because only integrity is affected, the primary concern is data trust and operational reliability rather than data disclosure, loss, or system takeover. Leadership should care because affected content could mislead users, disrupt downstream workflows, and erode confidence in the platform, even though no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include network isolation of DeepTutor 1.4.0, disablement of the confirm-proposal workflow if not required, reverse-proxy or API-gateway enforcement of authorization before confirm-proposal requests, WAF virtual patching, integrity monitoring for book metadata and spine changes, and audit logging and alerting for unauthorized modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB