CVE-2026-122151

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122151", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-04T18:23:57.414Z", "datePublished": "2026-11-05T01:00:28.934Z", "dateUpdated": "2026-11-05T20:32:49.382Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T01:00:28.934Z"}, "title": "Presenton User Configuration user-config JSON.parse cross-site request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-352", "lang": "en", "description": "Cross-Site Request Forgery"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-862", "lang": "en", "description": "Missing Authorization"}]}], "affected": [{"vendor": "n/a", "product": "Presenton", "versions": [{"version": "0.9.11-beta", "status": "affected"}, {"version": "0.9.12-beta", "status": "unaffected"}], "cpes": ["cpe:2.3:a:presenton:presenton:*:*:*:*:*:*:*:*"], "modules": ["User Configuration Handler"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-11-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-04T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-04T19:29:01.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "fifker (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/431151", "name": "VDB-431151 | Presenton User Configuration user-config JSON.parse cross-site request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431151/cti", "name": "VDB-431151 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122151", "name": "CVE-2026-122151 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1027429", "name": "Submit #1027429 | Presenton 0.9.11-beta Cross-Site Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://github.com/presenton/presenton/issues/975", "tags": ["issue-tracking"]}, {"url": "https://github.com/presenton/presenton/pull/980", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/user-attachments/files/33003219/default.md", "tags": ["exploit"]}, {"url": "https://github.com/presenton/presenton/commit/44c8a61122b21f17642d717b0c4d6f2c54c0f180", "tags": ["patch"]}, {"url": "https://github.com/presenton/presenton/releases/tag/v0.9.12-beta", "tags": ["patch"]}, {"url": "https://github.com/presenton/presenton/", "tags": ["product"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T20:32:33.638722Z", "id": "CVE-2026-122151", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:32:49.382Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122151", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T20:32:33.638722Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:32:43.351Z"}}], "cna": {"tags": ["x_open-source"], "title": "Presenton User Configuration user-config JSON.parse cross-site request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "fifker (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:presenton:presenton:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["User Configuration Handler"], "product": "Presenton", "versions": [{"status": "affected", "version": "0.9.11-beta"}, {"status": "unaffected", "version": "0.9.12-beta"}]}], "timeline": [{"lang": "en", "time": "2026-11-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-11-04T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-11-04T19:29:01.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/431151", "name": "VDB-431151 | Presenton User Configuration user-config JSON.parse cross-site request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431151/cti", "name": "VDB-431151 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122151", "name": "CVE-2026-122151 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1027429", "name": "Submit #1027429 | Presenton 0.9.11-beta Cross-Site Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://github.com/presenton/presenton/issues/975", "tags": ["issue-tracking"]}, {"url": "https://github.com/presenton/presenton/pull/980", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/user-attachments/files/33003219/default.md", "tags": ["exploit"]}, {"url": "https://github.com/presenton/presenton/commit/44c8a61122b21f17642d717b0c4d6f2c54c0f180", "tags": ["patch"]}, {"url": "https://github.com/presenton/presenton/releases/tag/v0.9.12-beta", "tags": ["patch"]}, {"url": "https://github.com/presenton/presenton/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "Cross-Site Request Forgery"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T01:00:28.934Z"}}}, "cveMetadata": {"cveId": "CVE-2026-122151", "state": "PUBLISHED", "dateUpdated": "2026-11-05T20:32:49.382Z", "dateReserved": "2026-11-04T18:23:57.414Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-11-05T01:00:28.934Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:presenton:presenton:*:*:*:*:*:*:*:*"], "modules": ["User Configuration Handler"], "product": "Presenton", "vendor": "n/a", "versions": [{"status": "affected", "version": "0.9.11-beta"}, {"status": "unaffected", "version": "0.9.12-beta"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component."}], "id": "CVE-2026-122151", "lastModified": "2026-11-05T21:18:43.087", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122151", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T20:32:33.638722Z", "version": "2.0.3"}}]}, "published": "2026-11-05T01:17:22.360", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/presenton/presenton/"}, {"source": "cna@vuldb.com", "url": "https://github.com/presenton/presenton/commit/44c8a61122b21f17642d717b0c4d6f2c54c0f180"}, {"source": "cna@vuldb.com", "url": "https://github.com/presenton/presenton/issues/975"}, {"source": "cna@vuldb.com", "url": "https://github.com/presenton/presenton/pull/980"}, {"source": "cna@vuldb.com", "url": "https://github.com/presenton/presenton/releases/tag/v0.9.12-beta"}, {"source": "cna@vuldb.com", "url": "https://github.com/user-attachments/files/33003219/default.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-122151"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1027429"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431151"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431151/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-862"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "presenton: presenton: Cross-Site Request Forgery via user configuration endpoint", "id": "2567603", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567603"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-346", "details": ["A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component.", "A flaw was found in Presenton. Due to improper request handling in the user configuration component, a remote attacker can trick an authenticated user into submitting an unauthorized request. This Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to alter the victim's configuration settings without their knowledge or consent."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122151", "public_date": "2026-11-05T01:00:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122151\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122151\nhttps://github.com/presenton/presenton/\nhttps://github.com/presenton/presenton/commit/44c8a61122b21f17642d717b0c4d6f2c54c0f180\nhttps://github.com/presenton/presenton/issues/975\nhttps://github.com/presenton/presenton/pull/980\nhttps://github.com/presenton/presenton/releases/tag/v0.9.12-beta\nhttps://github.com/user-attachments/files/33003219/default.md\nhttps://vuldb.com/cve/CVE-2026-122151\nhttps://vuldb.com/submit/1027429\nhttps://vuldb.com/vuln/431151\nhttps://vuldb.com/vuln/431151/cti"], "statement": "This vulnerability is rated as having a Moderate severity because successful exploitation requires user interaction to deceive an authenticated victim, restricting the blast radius to unauthorized modification of user-specific application preferences rather than broader system compromise. Red Hat enterprise products do not package or distribute Presenton, and typical Red Hat environments are not exposed to this issue.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.9.11-beta"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "0.9.12-beta"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Presenton", "source": "cna", "vendor": "n/a"}, "product": "presenton", "vendor": "presenton"}], "created": "2026-11-05T03:45:18.528806+00:00", "updated": "2026-11-06T14:45:05.209099+00:00", "vendors": ["presenton", "presenton$PRODUCT$presenton"]}