CVE-2026-121020mediumCWE-200

CVE-2026-121020: medium-severity vulnerability in AxxonSoft Axxon One

User and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration API

Published

Follow this CVE+ Monitor Axxon One

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.2%
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
AxxonSoft · Axxon One
Related CVEs — AxxonSoft Axxon One

In the same product, most dangerous first.

CVE-2026-121022CRITICALDefault Administrator Password Change Not Enforced in Axxon One Web ClientEPSS 0.4%CVE-2026-121021MEDIUMPlaintext Storage of LDAP Password in Axxon One Shared ConfigurationEPSS 0.1%