CVE-2026-58168

Name of the Vulnerable Software and Affected Versions DeepTutor versions prior to 1.4.10

Description An authorization bypass exists that allows low-privilege users to invoke unrestricted Model Context Protocol (MCP) tools. This occurs because the allowed mcp tools() function in deeptutor/multi user/tool access.py returns None instead of a denied result when mcp tools is omitted from a user's grant. Consequently, attackers or prompt-injected content within a user session can enumerate and invoke any configured MCP tool, such as filesystem, shell, and browser servers, leading to unauthorized access to sensitive deployment resources.

Recommendations Update to version 1.4.10 or later.