CVE-2026-122151 Presenton User Configuration user-config JSON.parse cross-site request forgery
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-122151?
CVE-2026-122151 is a medium-severity vulnerability in Presenton, published on 5 Nov 2026.
Official description
A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component.
Which versions are affected by CVE-2026-122151?
How do I fix CVE-2026-122151?
No fix has been published for CVE-2026-122151 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-122151 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-122151 exists.
Sources
Also known as GHSA-m6p5-h26j-pxv5.