Cross-site request forgery in Presenton user configuration handler
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Tampering, Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352 and CWE-862.
Summary
Presenton up to and including 0.9.11-beta contains a cross-site request forgery flaw in the User Configuration Handler, where the JSON.parse function of the /api/user-config endpoint can be manipulated. A remote attacker can launch the attack if a user interacts with a crafted page. A public exploit has been disclosed and may be used, and the sources list no CISA KEV entry for this flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Presenton | 0.9.11-beta | 0.9.12-beta | Patch available | CNA |
- Presenton Vendor— Affected 0.9.11-beta Fixed in 0.9.12-beta Patch available CNA
Remediation
Upgrade Presenton to version 0.9.12-beta, which fixes the issue with patch 44c8a61122b21f17642d717b0c4d6f2c54c0f180.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA Presenton Fixed in 0.9.12-beta
Vendor assessments
Timeline
- 2026-11-05 Threatist record created from CVE-2026-122151
- 2026-11-05 Alias added: GHSA-m6p5-h26j-pxv5
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Priority changed: LOW → MEDIUM
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Patch 3
Sources
- CVE-2026-122151 · CVE Program
- CVE-2026-122151 · NVD
- FIRST EPSS
- GHSA-m6p5-h26j-pxv5 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-122151 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences