Information disclosure in Presenton Desktop Authentication Middleware
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-284.
Summary
Presenton up to and including 0.9.11-beta has an information disclosure flaw in its Desktop Authentication Middleware, affecting an unspecified part of the /app_data file path (CWE-200). A remote, unauthenticated attacker can read sensitive information without privileges or user interaction. A public exploit has been disclosed and may be used.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Presenton | 0.9.11-beta | 0.9.12-beta | Patch available | CNA |
- Presenton Vendor— Affected 0.9.11-beta Fixed in 0.9.12-beta Patch available CNA
Remediation
Upgrade Presenton to version 0.9.12-beta, which fixes this issue. The sources name patch 44c8a61122b21f17642d717b0c4d6f2c54c0f180 for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA Presenton Fixed in 0.9.12-beta
Timeline
- 2026-11-01 Threatist record created from CVE-2026-120192
- 2026-11-01 Alias added: GHSA-rgjm-77r7-28xg
- 2026-11-02 Priority changed: MEDIUM → LOW
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Priority changed: LOW → HIGH
References
Patch 3
Sources
- CVE-2026-120192 · CVE Program
- CVE-2026-120192 · NVD
- FIRST EPSS
- GHSA-rgjm-77r7-28xg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences