CVE-2026-121020 Details
Description
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.
A vulnerability allowing the exposure of sensitive information to unauthorized users has been identified in AxxonSoft Axxon One versions prior to 3.2.0, on both Windows and Linux. This issue arises in the security configuration API, where a remote authenticated user with limited privileges can enumerate all user accounts and roles in the system. The vulnerability occurs because the user configuration request returns complete lists of users and roles, regardless of the caller's permissions.
Users are advised to upgrade to Axxon One version 3.2.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121020 | AxxonSoft | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | AxxonSoft |
Affected Products
| Product | Versions |
|---|---|
| AxxonSoft Axxon One | < 3.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | AxxonSoft |