CVE-2026-122151
Deferred Deferred - Pending Action

Cross-Site Request Forgery in Presenton

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulDB

Description
A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-122151
EUVD
EUVD-2026-117203

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a Presenton 0.9.11-beta

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site request forgery (CSRF) flaw in Presenton up to version 0.9.11-beta. It affects the JSON.parse function in the /api/user-config file, allowing attackers to manipulate the application's configuration remotely. The issue stems from improper Content-Type validation, enabling attackers to send text/plain requests that bypass CORS preflight checks and overwrite settings like LLM endpoints and API keys.

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected POST requests to /api/user-config with Content-Type: text/plain. Check if configuration files like userConfig.json are being modified without user interaction. Inspect Electron app processes for unauthorized local service interactions or file access attempts.

Impact Analysis

If exploited, this vulnerability allows attackers to hijack LLM traffic, steal sensitive data such as uploaded document text and API keys, and even destroy saved API keys. The attack requires the victim to have the Presenton app running and an attacker-controlled webpage open in their browser. Victims may unknowingly expose private data or lose access to their API keys.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using Presenton may face compliance breaches if user data is exposed or mishandled due to this flaw.

Mitigation Strategies

Immediately upgrade Presenton to version 0.9.12-beta or later. Disable the application if running older versions. Review and restrict network access to local services. Monitor for unauthorized configuration changes and API key exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122151. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...