CVE-2026-51876

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-01

Last updated on: 2026-10-06

Assigner: MITRE

Description

DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book_id to submit a confirm-proposal request for an existing book, causing unauthorized overwrites of persisted metadata and spine content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-51876

EUVD

EUVD-2026-91128

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

DeepTutor 1.4.0 has an authorization bypass flaw in its book confirmation process. An attacker without authentication or proper authorization can exploit a publicly exposed book_id to send a confirm-proposal request, leading to unauthorized changes in existing book metadata and spine content.

Impact Analysis

This vulnerability allows attackers to modify book data without permission, potentially altering or deleting important information. Users relying on DeepTutor for book management could face data corruption, loss of integrity, or unauthorized changes to stored content.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access or modification of sensitive data. Unauthorized overwrites of metadata and spine content may lead to unauthorized processing or disclosure of personal or protected health information, depending on the data stored in the system.

Mitigation Strategies

Immediately update DeepTutor to the latest version to patch the authorization bypass flaw. Review and restrict access to book_id endpoints to prevent unauthorized confirm-proposal requests. Monitor system logs for suspicious confirm-proposal submissions.

Hi! I’m here to help you understand CVE-2026-51876. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70