---
id: CVE-2026-122151
title: Presenton User Configuration user-config JSON.parse cross-site request forgery
summary: >-
  A security vulnerability has been detected in Presenton up to 0.9.11-beta.
  Impacted is the function JSON.parse of the file /api/user-config of the
  component User Configuration Handler. Such manipulation leads to cross-site
  request forger…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-352
  - CWE-862
product: Presenton
affected:
  - Presenton 0.9.11-beta
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:32:33.638722Z'
exploitAvailable: true
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:32:49.382Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122151'
references:
  - url: 'https://vuldb.com/vuln/431151'
    label: >-
      VDB-431151 | Presenton User Configuration user-config JSON.parse
      cross-site request forgery
  - url: 'https://vuldb.com/vuln/431151/cti'
    label: 'VDB-431151 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-122151'
    label: CVE-2026-122151 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1027429'
    label: 'Submit #1027429 | Presenton 0.9.11-beta Cross-Site Request Forgery'
  - url: 'https://github.com/presenton/presenton/issues/975'
  - url: 'https://github.com/presenton/presenton/pull/980'
  - url: 'https://github.com/user-attachments/files/33003219/default.md'
  - url: >-
      https://github.com/presenton/presenton/commit/44c8a61122b21f17642d717b0c4d6f2c54c0f180
  - url: 'https://github.com/presenton/presenton/releases/tag/v0.9.12-beta'
  - url: 'https://github.com/presenton/presenton/'
tags:
  - cve.org
  - exploit-available
epss: 0.00202
epssPercentile: 0.10162
ingestedAt: '2026-11-05T22:38:31.839Z'
---

## Overview

A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component.

## Affected

- `Presenton 0.9.11-beta`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.