The vulnerability originates from an improper handling of JSON.parse in the User Configuration Handler of Presenton. By sending crafted input to the /api/user-config endpoint, a remote attacker can trigger CSRF, causing a legitimate user’s browser to send authenticated requests to the application. This may lead to unauthorized data modification or actions executed under the victim’s credentials. The weakness is categorized as CWE‑352 and because the exploit can resolve with elevated privileges it also maps to CWE‑862.

Presenton products up to version 0.9.11‑beta are vulnerable. The flaw resides in the /api/user-config endpoint of the User Configuration Handler. Version 0.9.12‑beta includes a fix that removes the vulnerable JSON.parse usage, so all installations running 0.9.12‑beta or later are no longer affected.

The CVSS score of 5.3 denotes moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack is possible remotely and does not require local privileges; an attacker only needs the ability to cause a victim’s browser to access the vulnerable endpoint. Because CSRF defenses were absent, exploitation is trivial for an attacker with a compromised site or phishing capability.