CVE-2026-121020

MEDIUM 4.3

User and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration API

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.

CWE	CWE-200
Vendor	axxonsoft
Product	axxon one
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for axxonsoft axxon one

Be the first to know when new medium vulnerabilities affecting axxonsoft axxon one are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

AxxonSoft / Axxon One

0 < 3.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

axxonsoft.com: https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121020

Credits

Reported by a customer's information security team.