{"id":"CVE-2026-122151","kind":"vulnerability","aliases":["CVE-2026-122151"],"related":[],"title":"Presenton: user config endpoint allows cross-site request forgery","description":"A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component.","summary":"Presenton, an open-source presentation generator, has a flaw in its /api/user-config endpoint that lets a cross-site request forgery change user settings. An attacker can trigger the request remotely by tricking a logged-in user into visiting a malicious page.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","presenton","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Presenton version against `0.9.11-beta`; versions up to and including it are affected.\n- Look for the `/api/user-config` endpoint in your deployment.","fix":"- Upgrade Presenton to `0.9.12-beta`.","status":"open","published_at":"2026-11-05T01:17:22+00:00","first_seen_at":"2026-11-05T01:30:52+00:00","triaged_at":"2026-11-05T01:32:07+00:00","updated_at":"2026-11-05T01:32:07+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T01:32:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Presenton to `0.9.12-beta`.","reach":"internet","title":"Presenton: user config endpoint allows cross-site request forgery","impact":"medium","summary":"Presenton, an open-source presentation generator, has a flaw in its /api/user-config endpoint that lets a cross-site request forgery change user settings. An attacker can trigger the request remotely by tricking a logged-in user into visiting a malicious page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["presenton","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker changes user configuration through a victim's browser session","analyst_note":"Sources do not say which settings the endpoint changes or whether authentication is needed; check the Presenton 0.9.12-beta release notes for details.","how_to_check":"- Check the installed Presenton version against `0.9.11-beta`; versions up to and including it are affected.\n- Look for the `/api/user-config` endpoint in your deployment.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that self-host Presenton up to 0.9.11-beta and expose its web interface to users who also browse other sites. Deployments that are not reachable from users' browsers, or that run only locally, are less exposed. The sources do not say whether authentication is required.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4328,"output_tokens":529,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122151':13A,16A '-2026':12A,15A '/api/user-config':34B,86C '0.9.11':76C '0.9.12':123C '44c8a61122b21f17642d717b0c4d6f2c54c0f180':137C 'address':128C 'affect':144C 'allow':5A 'attack':48B,108C 'beta':77C,124C 'chang':44B 'compon':89C,145C 'config':3A 'configur':91C 'cross':7A,40B,98C 'cross-sit':6A,39B,97C 'cve':11A,14A 'detect':71C 'disclos':114C 'endpoint':4A,35B 'exploit':111C 'file':85C 'flaw':31B 'forgeri':10A,43B,101C 'function':81C 'generat':28B 'handler':92C 'host':21B 'impact':78C 'issu':130C 'json.parse':82C 'launch':106C 'lead':95C 'let':37B 'log':58B 'logged-in':57B 'malici':64B 'manipul':94C 'may':117C 'name':132C 'open':25B 'open-sourc':24B 'page':65B 'patch':135C 'possibl':104C 'present':27B 'presenton':1A,18B,22B,73C 'public':115C 'recommend':126C,140C 'remot':53B,109C 'request':9A,42B,52B,100C 'secur':67C 'self':20B 'self-host':19B 'set':46B 'site':8A,41B,99C 'sourc':26B 'trick':55B 'trigger':50B 'upgrad':120C,142C 'use':119C 'user':2A,45B,60B,90C 'version':122C 'visit':62B 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Presenton up to 0.9.11-beta and expose its web interface to users who also browse other sites. Deployments that are not reachable from users' browsers, or that run only locally, are less exposed. The sources do not say whether authentication is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","presenton","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T01:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122151","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122151","severity":null,"published_at":"2026-11-05T01:17:22+00:00","modified_at":"2026-11-05T01:17:22+00:00","first_seen_at":"2026-11-05T01:30:52+00:00","fetched_at":"2026-11-05T01:30:52+00:00","note":null}],"documents":[{"id":50280,"url":"https://github.com/presenton/presenton/commit/44c8a61122b21f17642d717b0c4d6f2c54c0f180","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":50281,"url":"https://github.com/presenton/presenton/releases/tag/v0.9.12-beta","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}