Skip to content
Sign in
5.3 Medium

CVE-2026-122151 Presenton User Configuration user-config JSON.parse cross-site request forgery

Description

A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Exploitable remotely over the network, without an account and if a user takes an action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
Interaction
Passive
Confidentiality
None
Integrity
Low
Availability
None
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
Presenton 0.9.11-beta 0.9.12-beta

Other CVEs of Presenton

The 3 CVEs of Presenton →
CVE-2026-120192 A security vulnerability has been detected in Presenton up to 0.9.11-beta 6.9 Medium CVE-2026-120191 A weakness has been identified in Presenton up to 0.9.11-beta 6.9 Medium
Track this CVE