CVE-2026-120191
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
A weakness has been identified in Presenton up to 0.9.11-beta in some unknown functionality of the API component, causing missing authentication. The attack can be initiated remotely, and the exploit has been made public. Upgrading to version 0.9.12-beta resolves the issue.
Risk Assessment
Missing authentication in the API may allow an unauthenticated attacker to access protected functionality and data. The public availability of the exploit increases the likelihood of abuse.
Recommendation
Upgrade Presenton to version 0.9.12-beta or later, which contains the fix. Until then, restrict network access to the API.
Other vulnerabilities in Presenton
See all- CVE-2026-120192Medium
A security vulnerability has been detected in Presenton up to 0.9.11-beta. It affects an unknown part of the /app_data file in the Desktop Authentication Middleware component and leads to information disclosure. The attack can be launched remotely, and a public exploit is already available.
- CVE-2026-58446Medium
A vulnerability in Presenton before version 0.8.8-beta allows an unauthenticated remote attacker to invoke MCP tools such as generate_presentation by accessing the /mcp path without authentication. This occurs because the nginx front-end does not apply the auth_request gate to that path, and the MCP server auto-mints a valid internal session token for the configured user.
Original NVD description (English source)
A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.12-beta can resolve this issue. Patch name: 44c8a61122b21f17642d717b0c4d6f2c54c0f180. You should upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS