Vulnerability PYSEC-2026-4206
High Risk
HIGH RISK
CVSS Score: 8.8
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
7 hours ago
October 15, 2026 at 10:22 AM UTC
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
1.4.0b0 - 1.4.9
1.4.0b0 - 1.4.9
Summary
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Details
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Impacted packages
Timeline
Published
7 hours ago
October 15, 2026 at 10:22 AM UTC
Fixed (1.4.10)
3 months ago
June 21, 2026 at 07:04 AM UTC
Last Modified
2 hours ago
October 15, 2026 at 02:45 PM UTC