CVE-2026-120192
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
A security vulnerability has been detected in Presenton up to 0.9.11-beta. It affects an unknown part of the /app_data file in the Desktop Authentication Middleware component and leads to information disclosure. The attack can be launched remotely, and a public exploit is already available.
Risk Assessment
Information disclosure may lead to leakage of sensitive data or application configuration. Since the exploit is public, the risk of exploitation is high.
Recommendation
Upgrade Presenton to version 0.9.12-beta (patch 44c8a61122b21f17642d717b0c4d6f2c54c0f180) as soon as possible. Until the upgrade, restrict access to the application.
Other vulnerabilities in Presenton
See all- CVE-2026-120191High
A weakness has been identified in Presenton up to 0.9.11-beta in some unknown functionality of the API component, causing missing authentication. The attack can be initiated remotely, and the exploit has been made public. Upgrading to version 0.9.12-beta resolves the issue.
- CVE-2026-58446Medium
A vulnerability in Presenton before version 0.8.8-beta allows an unauthenticated remote attacker to invoke MCP tools such as generate_presentation by accessing the /mcp path without authentication. This occurs because the nginx front-end does not apply the auth_request gate to that path, and the MCP server auto-mints a valid internal session token for the configured user.
Original NVD description (English source)
A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS