The flaw in DeepSeek V4 arises from an Incorrect Access Control issue that can be activated by sending a specially crafted input. This vulnerability could allow an adversary to access or manipulate data and functionality that should be restricted, compromising confidentiality, integrity, or availability of the application or underlying resources.

The issue affects DeepSeek V4. No specific product or version range is provided beyond the V4 designation, so any current release of DeepSeek V4 may be impacted until a vendor patch or mitigation is deployed. The vendor name is not listed in the CNA data.

The EPSS score is 0.00397 (less than 1%) and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 9.1, indicating a critical severity. Nonetheless, an Incorrect Access Control flaw carries a high exploitation potential if an attacker can reach the vulnerable component. The attack vector is inferred to be remote or network‑based, requiring the ability to transmit the crafted request to an exposed interface. If the affected interface is exposed to the wider network, the risk is significant until patched or mitigated. Limiting access and validating input are essential countermeasures in the interim.