Description
A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded.
Published: 2026-11-01
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Patch Now
AI Analysis

Impact

The vulnerability resides in the Desktop Authentication Middleware component of Presenton prior to version 0.9.11-beta. A flaw in handling the /app_data file permits an attacker to read sensitive configuration or credential data. This leads to information disclosure that can undermine the confidentiality of the system. The weakness corresponds to CWE-200 and CWE-284 due to improper access control.

Affected Systems

Affected products are Presenton's Desktop Authentication Middleware, version 0.9.11-beta and earlier. The vendor released a fix in v0.9.12-beta that addresses the issue. The patch commit hash is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. Users of any version before 0.9.12-beta are directly impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting it has not yet been widely exploited in the wild. However, the attack can be launched remotely and the exploit has already been publicly disclosed, raising the likelihood that a determined attacker could target vulnerable installations. The impact is limited to confidentiality loss; there is no evidence of impact to integrity or availability.

Generated by OpenCVE AI on November 1, 2026 at 03:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the provided patch by upgrading Presenton to version 0.9.12-beta or later.
  • If a version upgrade cannot be performed immediately, restrict access to the /app_data endpoint by applying authentication or network restrictions so that only authorized local processes can read it.
  • Enable logging and monitoring of read attempts to /app_data and configure alerts for anomalous activity to detect potential exploitation.

Generated by OpenCVE AI on November 1, 2026 at 03:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 01 Nov 2026 02:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded.
Title Presenton Desktop Authentication Middleware app_data information disclosure
First Time appeared Presenton
Presenton presenton
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:presenton:presenton:*:*:*:*:*:*:*:*
Vendors & Products Presenton
Presenton presenton
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Presenton Presenton
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-01T01:45:24.422Z

Reserved: 2026-10-31T08:20:47.301Z

Link: CVE-2026-120192

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-01T02:16:59.980

Modified: 2026-11-01T02:16:59.980

Link: CVE-2026-120192

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-01T03:45:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control