Presenton API Authentication and Info Disclosure

Presenton's Electron desktop build, in versions up to and including 0.9.11-beta, exposes private application files through its internal HTTP services because those services run with authentication disabled and without a per-launch credential, letting a client that can reach them read configuration, database, log and export-task data under /app_data. Only the desktop (PRESENTON_ELECTRON=true) deployment mode is affected, and because the Next.js/FastAPI servers are loopback/internal services, practical reachability likely depends on a co-located local client or a browser-based cross-origin/cross-port path rather than arbitrary internet access; the impact is confidentiality-only and limited. A public PoC reference exists; it is not verified as working exploit code, and there is no confirmed active exploitation (CISA KEV). Vuln.today priority places this in the current monthly remediation cycle rather than an emergency response.

Presenton 0.9.11-beta and earlier ship an Electron desktop build whose local Next.js and FastAPI HTTP servers accept requests without authentication, allowing anonymous clients that can reach those loopback services to use internal REST, export and local-file-read functionality and to read files the app can access. Exploitation is narrowed by the loopback binding: a genuinely remote attacker needs local access to the host or must induce a victim's browser to issue cross-port or DNS-rebinding requests to localhost, so the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N yielding low confidentiality, integrity and availability impact. The CVSS 4.0 vector supplied by the CNA rates exploitation maturity as proof-of-concept (E:P) and the CVE text asserts that exploit code has been made public; that claim is not independently verified here, no CISA KEV entry is associated, and the vendor resolves the issue in 0.9.12-beta.