{"id":"CVE-2026-120191","kind":"vulnerability","aliases":["CVE-2026-120191"],"related":[],"title":"Presenton: API endpoint lacks authentication, allowing remote access to functions","description":"A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.12-beta can resolve this issue. Patch name: 44c8a61122b21f17642d717b0c4d6f2c54c0f180. You should upgrade the affected component.","summary":"Presenton, an open-source presentation generator, has an API function that does not require authentication. A remote attacker can call it without logging in, and a public exploit has been published.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api","package","presenton","self-hosted"],"not_affected_if":["not-running-presenton","version-0.9.12-beta-or-later"],"how_to_check":"- Check the installed Presenton version against the affected range (up to `0.9.11-beta`)\n- Find out whether the Presenton API is reachable from the internet or untrusted networks","fix":"- Upgrade Presenton to `0.9.12-beta` or later","status":"open","published_at":"2026-11-01T01:17:17+00:00","first_seen_at":"2026-11-01T01:47:20+00:00","triaged_at":"2026-11-01T01:47:34+00:00","updated_at":"2026-11-01T01:47:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-01T01:47:34Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Presenton to `0.9.12-beta` or later","reach":"internet","title":"Presenton: API endpoint lacks authentication, allowing remote access to functions","impact":"medium","summary":"Presenton, an open-source presentation generator, has an API function that does not require authentication. A remote attacker can call it without logging in, and a public exploit has been published.","audience":"businesses","category":"package","nicknames":[],"who_cares":["presenton","self-hosted","api"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated remote attacker invokes protected API functions","analyst_note":"Identify which API endpoint lacks authentication and what data or actions it exposes, using the NVD entry and the linked patch 44c8a61122b21f17642d717b0c4d6f2c54c0f180.","how_to_check":"- Check the installed Presenton version against the affected range (up to `0.9.11-beta`)\n- Find out whether the Presenton API is reachable from the internet or untrusted networks\n- unknown for the specific API endpoint that lacks authentication","plain_action":"","needs_analyst":true,"not_affected_if":["not-running-presenton","version-0.9.12-beta-or-later"],"who_is_affected":"Teams running self-hosted Presenton up to 0.9.11-beta whose API is reachable over the network. The sources do not name the specific endpoint, so unknown whether a default configuration is exposed. Teams not running Presenton, or running a later version, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4173,"output_tokens":569,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120191':13A,16A '-2026':12A,15A '0.9.11':64C '0.9.12':109C '44c8a61122b21f17642d717b0c4d6f2c54c0f180':117C 'access':8A 'affect':66C,122C 'allow':6A 'api':2A,17B,32B,77C 'attack':41B,89C,105C 'authent':5A,38B,82C 'avail':96C 'beta':65C,110C 'call':43B 'caus':80C 'compon':76C,123C 'could':101C 'cve':11A,14A 'endpoint':3A 'exploit':51B,92C 'function':10A,33B,73C 'generat':29B 'host':22B 'identifi':59C 'initi':87C 'issu':69C,114C 'lack':4A 'log':46B 'made':95C 'manipul':79C 'miss':81C 'name':116C 'open':26B 'open-sourc':25B 'packag':18B 'patch':115C 'possibl':85C 'present':28B 'presenton':1A,19B,23B,61C 'public':50B,99C 'publish':54B 'remot':7A,40B,90C 'requir':37B 'resolv':112C 'self':21B 'self-host':20B 'sourc':27B 'unknown':72C 'upgrad':106C,120C 'use':103C 'version':108C 'weak':56C 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Presenton up to 0.9.11-beta whose API is reachable over the network. The sources do not name the specific endpoint, so unknown whether a default configuration is exposed. Teams not running Presenton, or running a later version, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T01:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120191","severity":null,"published_at":"2026-11-01T01:17:17+00:00","modified_at":"2026-11-01T01:17:17+00:00","first_seen_at":"2026-11-01T01:47:20+00:00","fetched_at":"2026-11-01T01:47:20+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}