CVE-2026-120192 in Presenton
Summary
by MITRE • 11/01/2026
A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified in Presenton versions up to 0.9.11-beta represents a critical security flaw within the Desktop Authentication Middleware, specifically affecting the handling of files located in the /app_data directory. This issue is classified as an information disclosure vulnerability, which falls under the broader category of CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The core technical failure lies in the middleware's inability to properly restrict access or sanitize data within this specific application data path, allowing attackers to retrieve sensitive files that were intended for internal use only. This misconfiguration creates a direct pathway for unauthorized entities to extract confidential information from the system without requiring prior authentication credentials in many scenarios, significantly lowering the barrier for exploitation.
From an operational perspective, the impact of this vulnerability is severe due to its remote exploitability. Because the attack vector is network-based, threat actors can launch exploits against vulnerable instances over the internet or internal networks without physical access to the target machine. The fact that a public proof-of-concept has been disclosed means that automated scanning tools and malicious scripts are likely already leveraging this flaw in the wild. Successful exploitation could lead to the exposure of user credentials, session tokens, configuration secrets, or other proprietary data stored within the /app_data directory. This compromise undermines the confidentiality integrity required for secure desktop authentication processes and can serve as a stepping stone for further lateral movement or privilege escalation attacks within an organization's infrastructure.
The remediation strategy is straightforward but requires immediate action to mitigate risk. Organizations running Presenton versions up to 0.9.11-beta must upgrade immediately to version 0.9.12-beta, which incorporates the necessary code changes to resolve this access control flaw. The specific patch addressing this issue is identified by the commit hash 44c8a61122b21f17642d717b0c4d6f2c54c0f180, which likely implements stricter file system permissions or input validation mechanisms within the Desktop Authentication Middleware. Until this upgrade is applied, administrators should consider implementing network-level controls such as firewall rules to restrict access to the affected endpoints and monitoring logs for any suspicious requests targeting the /app_data path. Continuous vulnerability management practices should be employed to ensure that all components are kept up-to-date with security patches released by the vendor.