{"id":"CVE-2026-120192","kind":"vulnerability","aliases":["CVE-2026-120192"],"related":[],"title":"Presenton: desktop authentication middleware exposes files under app_data","description":"A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded.","summary":"Presenton, an AI presentation generator, has a flaw in its desktop authentication middleware that lets a remote attacker read files under /app_data. The exploit has been published publicly.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-apps","ai-tooling","presenton","self-hosted"],"not_affected_if":["version-0.9.12-beta-or-later"],"how_to_check":"- Check the Presenton version in use and whether it is `0.9.11-beta` or earlier.\n- Confirm whether the desktop authentication middleware is reachable from the network.","fix":"- Upgrade Presenton to `0.9.12-beta` or later (the sources name patch 44c8a61122b21f17642d717b0c4d6f2c54c0f180).","status":"open","published_at":"2026-11-01T02:16:59+00:00","first_seen_at":"2026-11-01T02:47:27+00:00","triaged_at":"2026-11-01T02:47:49+00:00","updated_at":"2026-11-01T02:47:49+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-11-01T02:47:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Presenton to `0.9.12-beta` or later (the sources name patch 44c8a61122b21f17642d717b0c4d6f2c54c0f180).","reach":"internet","title":"Presenton: desktop authentication middleware exposes files under app_data","impact":"medium","summary":"Presenton, an AI presentation generator, has a flaw in its desktop authentication middleware that lets a remote attacker read files under /app_data. The exploit has been published publicly.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["presenton","ai-apps","self-hosted"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"remote attacker reads files under the app data directory","analyst_note":"Confirm the exact affected component and whether authentication is required; the NVD entry is the only source.","how_to_check":"- Check the Presenton version in use and whether it is `0.9.11-beta` or earlier.\n- Confirm whether the desktop authentication middleware is reachable from the network.","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.9.12-beta-or-later"],"who_is_affected":"Teams running Presenton up to version 0.9.11-beta, particularly where the desktop authentication middleware is reachable remotely. The sources do not describe a specific default configuration, so exposure beyond the version range is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":4195,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120192':12A,15A '-2026':11A,14A '/app_data':47B,74C '0.9.11':64C '0.9.12':108C '44c8a61122b21f17642d717b0c4d6f2c54c0f180':122C 'abl':111C 'affect':67C,124C 'ai':17B,20B,28B 'ai-app':16B 'ai-tool':19B 'app':8A,18B 'attack':43B,93C 'authent':3A,37B,79C 'beta':65C,109C 'compon':77C,125C 'cve':10A,13A 'data':9A 'desktop':2A,36B,78C 'detect':59C 'disclos':99C 'disclosur':86C 'exploit':49B,96C 'expos':5A 'file':6A,45B,73C 'flaw':33B 'generat':30B 'host':25B 'inform':85C 'issu':115C 'launch':91C 'lead':83C 'let':40B 'manipul':82C 'may':102C 'middlewar':4A,38B,80C 'mitig':113C 'name':117C 'part':70C 'patch':120C 'possibl':89C 'present':29B 'presenton':1A,22B,26B,61C 'public':53B,100C 'publish':52B 'read':44B 'remot':42B,94C 'secur':55C 'self':24B 'self-host':23B 'tool':21B 'unknown':69C 'upgrad':105C,128C 'use':104C 'version':107C 'vulner':56C","nicknames":[],"mitigations":[],"who_affected":"Teams running Presenton up to version 0.9.11-beta, particularly where the desktop authentication middleware is reachable remotely. The sources do not describe a specific default configuration, so exposure beyond the version range is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T02:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120192","severity":null,"published_at":"2026-11-01T02:16:59+00:00","modified_at":"2026-11-01T02:16:59+00:00","first_seen_at":"2026-11-01T02:47:27+00:00","fetched_at":"2026-11-01T02:47:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}