CVE-2026-120191 Details
Description
A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.12-beta can resolve this issue. Patch name: 44c8a61122b21f17642d717b0c4d6f2c54c0f180. You should upgrade the affected component.
A vulnerability allowing missing authentication has been identified in Presenton versions through 0.9.11-beta. This issue arises in the Electron desktop application, which defaults to authentication being disabled. As a result, local APIs can be accessed without authentication, leading to potential exploitation such as credential theft and unauthorized access to application data. The vulnerability can be reproduced by loading an attacker-controlled page in a browser within the user's session, which can then access the unsecured local APIs.
Users can upgrade to Presenton version 0.9.12-beta, which restores authentication to the desktop application by default and secures the local APIs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/presenton/presenton/ | [email protected] | ProductSource CodeVendor |
| https://github.com/presenton/presenton/commit/44c8a61122b21f17642d717b0c4d6f2c54c0f180 | [email protected] | Source CodeVendor |
| https://github.com/presenton/presenton/issues/972 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/presenton/presenton/pull/980 | [email protected] | Issue TrackingVendor |
| https://github.com/presenton/presenton/releases/tag/v0.9.12-beta | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-120191 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1027384 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/429530 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/429530/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Presenton | <= 0.9.11-beta (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | [email protected] |