Presenton versions up to 0.9.11‑beta contain a flaw in an API endpoint that omits authentication checks. The weakness, classified as Authentication Failure (CWE‑287) and Missing Authentication (CWE‑306), permits an attacker to invoke protected operations without providing valid credentials. Because the API is reachable over the network, an unauthenticated user can read or modify presentation data and potentially leverage the exposed functionality for further attacks within the system.

The software component is the presenton presentation platform. The vulnerable releases are all versions up to 0.9.11‑beta. Upgrading to v0.9.12‑beta applies the authentication guard that eliminates the issue.

Because the flaw is exploitable remotely without any local privileges and a public exploit is already circulating, the risk is moderate with a CVSS score of 6.9. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so the current exploitation frequency is unclear. The likely attack vector is a network‑based request to the unsecured API endpoint, enabling unauthorized access to protected resources.