CVE-2026-51879

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-01

Last updated on: 2026-10-05

Assigner: MITRE

Description

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-51879

EUVD

EUVD-2026-91126

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

deeptutor 1.4.0 has an authorization bypass flaw in TutorBotManager.write_bot_file. This allows remote attackers to exploit a user-controlled object identifier to enumerate bot IDs and overwrite another bot's whitelisted control files via the HTTP tutorbot file route.

Detection Guidance

Check for unauthorized access to bot files via the HTTP tutorbot file route. Monitor logs for unusual enumeration of bot IDs or file overwrite attempts. Inspect deeptutor 1.4.0 installations for suspicious HTTP requests targeting the TutorBotManager.write_bot_file endpoint.

Impact Analysis

An attacker could manipulate or delete bot configurations, leading to service disruption or unauthorized access to tutoring functions. Sensitive data processed by affected bots may also be compromised.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance risks include data breaches and lack of audit controls.

Mitigation Strategies

Upgrade deeptutor to a patched version if available. Restrict access to the HTTP tutorbot file route by implementing authentication and authorization controls. Disable or block the TutorBotManager.write_bot_file functionality if not required. Monitor network traffic for exploitation attempts.

Hi! I’m here to help you understand CVE-2026-51879. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70