---
id: "CVE-2026-120191"
kind: "vulnerability"
aliases: ["CVE-2026-120191"]
title: "Presenton: API endpoint lacks authentication, allowing remote access to functions"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["api", "package", "presenton", "self-hosted"]
not_affected_if: ["not-running-presenton", "version-0.9.12-beta-or-later"]
published_at: "2026-11-01T01:17:17+00:00"
first_seen_at: "2026-11-01T01:47:20+00:00"
updated_at: "2026-11-01T01:47:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120191", "first_seen_at": "2026-11-01T01:47:20+00:00"}]
---

# Presenton: API endpoint lacks authentication, allowing remote access to functions

Presenton, an open-source presentation generator, has an API function that does not require authentication. A remote attacker can call it without logging in, and a public exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Presenton version against the affected range (up to `0.9.11-beta`)
- Find out whether the Presenton API is reachable from the internet or untrusted networks

## Fix

- Upgrade Presenton to `0.9.12-beta` or later

## Timeline

- 2026-11-01T01:47:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120191

## From the sources

A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.12-beta can resolve this issue. Patch name: 44c8a61122b21f17642d717b0c4d6f2c54c0f180. You should upgrade the affected component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_