{"id":"CVE-2026-122151","title":"Presenton User Configuration user-config JSON.parse cross-site request forgery","summary":"A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forger…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-352","CWE-862"],"product":"Presenton","affected":["Presenton 0.9.11-beta"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:32:33.638722Z"},"exploitAvailable":true,"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:32:49.382Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122151","references":[{"url":"https://vuldb.com/vuln/431151","label":"VDB-431151 | Presenton User Configuration user-config JSON.parse cross-site request forgery"},{"url":"https://vuldb.com/vuln/431151/cti","label":"VDB-431151 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-122151","label":"CVE-2026-122151 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1027429","label":"Submit #1027429 | Presenton 0.9.11-beta Cross-Site Request Forgery"},{"url":"https://github.com/presenton/presenton/issues/975"},{"url":"https://github.com/presenton/presenton/pull/980"},{"url":"https://github.com/user-attachments/files/33003219/default.md"},{"url":"https://github.com/presenton/presenton/commit/44c8a61122b21f17642d717b0c4d6f2c54c0f180"},{"url":"https://github.com/presenton/presenton/releases/tag/v0.9.12-beta"},{"url":"https://github.com/presenton/presenton/"}],"tags":["cve.org","exploit-available"],"epss":0.00202,"epssPercentile":0.10162,"ingestedAt":"2026-11-05T22:38:31.839Z","slug":"CVE-2026-122151","body":"## Overview\n\nA security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component.\n\n## Affected\n\n- `Presenton 0.9.11-beta`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}