{"id":"CVE-2026-52394","published":"2026-10-13T18:17:24.103","lastModified":"2026-10-16T19:56:15.773","description":"DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-201","CWE-209"],"vendors":[],"products":[],"references":[{"url":"http://deepseek.com","tags":[]},{"url":"https://gist.github.com/CAPTAIN1275/48a0b7d67d0e58cb05c607e0d715447c","tags":[]},{"url":"https://gist.github.com/CAPTAIN1275/48a0b7d67d0e58cb05c607e0d715447c","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/CAPTAIN1275/48a0b7d67d0e58cb05c607e0d715447c","tags":[]},{"url":"https://gist.github.com/CAPTAIN1275/48a0b7d67d0e58cb05c607e0d715447c","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows attackers to bypass access controls through crafted inputs, potentially leading to unauthorized data exposure and manipulation in DeepSeek V4 systems.","exploitability":"Exploitation is likely straightforward with minimal preconditions, requiring only a way to submit crafted input to the vulnerable system component.","blast_radius":"The impact could be significant across all users of DeepSeek V4, potentially exposing sensitive data and allowing manipulation of system behavior without authentication.","remediation":"No fixed version is published. Disable the affected feature or restrict access to the named endpoint until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["access-control","data-exfiltration","vulnerability"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:56:35.435Z"}}