DeepTutor version 1.4.0 suffers from an authorization bypass in its book confirmation flow. An attacker who is not logged in or who lacks proper privileges can reuse a publicly visible book identifier to submit a confirm‑proposal request for a book that already exists. This allows an unauthorized party to overwrite persisted metadata and the spine content of the book, leading to integrity violations and potential misinformation.

The vulnerability affects the open‑source DeepTutor platform, specifically version 1.4.0. No other versions or vendor releases are known to be impacted based on the supplied data.

The exploitability is high because the trigger endpoint is publicly exposed and relies on a single input parameter that can be fabricated. The CVSS score of 9.1 indicates critical severity, and the EPSS score of <1% suggests a low probability of widespread exploitation at the current time, yet the vulnerability could still be leveraged by any entity with network access to the service due to the lack of authentication. The defect is not listed in the CISA KEV catalog, yet the impact on data integrity warrants immediate remediation.