Live › vulnerability › CVE-2026-121020
Axxon One before 3.2.0 on Windows and Linux returns the complete list of user accounts and roles from its security configuration API, whatever the caller's permissions. A remote attacker with a limited-privilege account can enumerate every user and role on the system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 09:19 UTC. All times on this page are UTC.
Axxon One installations before 3.2.0 on Windows or Linux that have users with limited privileges reachable over the network. The exposure is user and role enumeration, not code execution. Systems already on 3.2.0 or later are not affected.
No product ranges from the sources yet.
3.2.03.2.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.
This page as .md · .json · in your agent: get_signal("CVE-2026-121020")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.