OCTOBER 6, 2026
Live Feed
Back to database
Case File

CVE-2026-51876

CRITICAL · CVSS 9.1 EPSS 0.15% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-10-01 · Last synced 2026-10-06

CyberRota Analysis

AI-Generated

DeepTutor 1.4.0 is vulnerable to an authorization bypass in the book confirmation process, allowing unauthenticated users to exploit exposed book IDs to submit confirm-proposal requests. This can lead to unauthorized overwrites of critical metadata and spine content, potentially compromising the integrity of the application’s data. Organizations using this version of DeepTutor should prioritize remediation to prevent unauthorized access and data manipulation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
gist.github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-51876
Severity
CRITICAL
CVSS
9.1
EPSS
0.15%

Original NVD Description

DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book_id to submit a confirm-proposal request for an existing book, causing unauthorized overwrites of persisted metadata and spine content.