CVE-2026-121020mediumCWE-200

CVE-2026-121020: falha de média gravidade em AxxonSoft Axxon One

User and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration API

Publicada em

Seguir esta CVE+ Monitorar Axxon One

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.2%
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
AxxonSoft · Axxon One
CVEs relacionadas — AxxonSoft Axxon One

No mesmo produto, das mais perigosas para as menos.

CVE-2026-121022CRITICALDefault Administrator Password Change Not Enforced in Axxon One Web ClientEPSS 0.4%CVE-2026-121021MEDIUMPlaintext Storage of LDAP Password in Axxon One Shared ConfigurationEPSS 0.1%