CVE-2026-58168: DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools

DeepTutor's multi-user mode keeps per-user grants in deeptutor/multi_user/tool_access.py. The function allowed_mcp_tools should return the set of MCP tools a user may use. When a grant has no mcp_tools key, it returns None instead of a denied result, and callers read None as no restriction.

Any authenticated low-privilege account whose grant leaves out mcp_tools therefore gets the full list of MCP servers the deployment has configured. The advisory names filesystem, shell and browser servers. The attacker needs a valid account and nothing else. The agent chat itself is a second route: prompt-injected content that the model reads during a session acts with the same user's reach, so a crafted document or web page can make the agent call those tools.

The practical result is file access, command execution and browsing from the host that runs DeepTutor, with the host's privileges. The CVSS 3.1 vector is network, low privilege, no user interaction, with high impact on all three properties.

The deeptutor pip package before 1.4.10, in deployments that use multi-user mode, have at least one MCP server configured, and have non-admin users whose grants lack mcp_tools. Single-user setups with no non-admin accounts are not in that situation.

pip show deeptutor

Upgrade to deeptutor 1.4.10.

pip install --upgrade deeptutor==1.4.10

Pull request 579 changes allowed_mcp_tools() so a real non-admin user with no mcp_tools grant gets an empty set. Admins stay unrestricted. After upgrading, non-admin users lose MCP access until you give them an explicit mcp_tools grant naming the tools they need. The sources give no workaround before the upgrade. Until then, remove shell and filesystem MCP servers from the configuration if non-admin users have access.

Review every non-admin user grant for a missing mcp_tools entry. Those accounts are the exposed ones. Then check the logs of your MCP servers, especially shell, filesystem and browser servers, for calls made on behalf of users who should not have had them. The sources document no DeepTutor log line for this flaw.

DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources.