{"id":"CVE-2026-121020","kind":"vulnerability","aliases":["CVE-2026-121020"],"related":[],"title":"AxxonSoft Axxon One: low-privilege users can list all accounts and roles","description":"Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.","summary":"Axxon One before 3.2.0 on Windows and Linux returns the complete list of user accounts and roles from its security configuration API, whatever the caller's permissions. A remote attacker with a limited-privilege account can enumerate every user and role on the system.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["axxon-one","infrastructure","linux","video-surveillance","windows"],"not_affected_if":["version-3.2.0-or-later"],"how_to_check":"- Check the installed Axxon One version and confirm whether it is earlier than `3.2.0`","fix":"- Axxon One: move to `3.2.0` or later","status":"open","published_at":"2026-11-03T09:17:11+00:00","first_seen_at":"2026-11-03T09:19:51+00:00","triaged_at":"2026-11-03T09:20:28+00:00","updated_at":"2026-11-03T09:20:28+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-03T09:20:28Z","model":"claude-haiku-5-5","output":{"fix":"- Axxon One: move to `3.2.0` or later","reach":"network","title":"AxxonSoft Axxon One: low-privilege users can list all accounts and roles","impact":"low","summary":"Axxon One before 3.2.0 on Windows and Linux returns the complete list of user accounts and roles from its security configuration API, whatever the caller's permissions. A remote attacker with a limited-privilege account can enumerate every user and role on the system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["axxon-one","video-surveillance","windows","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker lists all user accounts and roles on the system","analyst_note":"","how_to_check":"- Check the installed Axxon One version and confirm whether it is earlier than `3.2.0`\n- unknown for any other check, since the sources do not say","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.2.0-or-later"],"who_is_affected":"Axxon One installations before 3.2.0 on Windows or Linux that have users with limited privileges reachable over the network. The exposure is user and role enumeration, not code execution. Systems already on 3.2.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00066,"input_tokens":4167,"output_tokens":486,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121020':16A,19A '-200':83C '-2026':15A,18A '3.2.0':32B,94C 'account':11A,43B,64B,111C 'actor':81C 'allow':99C 'api':50B,88C 'attack':58B 'authent':102C 'axxon':2A,21B,29B,91C 'axxon-on':20B 'axxonsoft':1A,90C 'caller':53B,135C 'complet':39B,126C 'configur':49B,87C,114C,121C 'cve':14A,17A 'cwe':82C 'enumer':66B,108C 'everi':67B 'exposur':74C 'inform':77C 'infrastructur':23B 'limit':62B,105C 'limited-privileg':61B 'linux':24B,36B,98C 'list':9A,40B,127C 'low':5A 'low-privileg':4A 'one':3A,22B,30B,92C 'permiss':55B,137C 'privileg':6A,63B,106C 'regardless':132C 'remot':57B,101C 'request':122C 'return':37B,124C 'role':13A,45B,70B,113C,131C 'secur':48B,86C 'sensit':76C 'surveil':27B 'system':73B,117C 'unauthor':80C 'user':7A,42B,68B,103C,110C,120C,129C 'via':118C 'video':26B 'video-surveil':25B 'whatev':51B 'window':28B,34B,96C","nicknames":[],"mitigations":[],"who_affected":"Axxon One installations before 3.2.0 on Windows or Linux that have users with limited privileges reachable over the network. The exposure is user and role enumeration, not code execution. Systems already on 3.2.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["axxonone","infrastructure","linux","medium","videosurveillance","windows"],"first_public_at":"2026-11-03T09:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"15ede60e-6fda-426e-be9c-e788f151a377","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121020","severity":null,"published_at":"2026-11-03T09:17:11+00:00","modified_at":"2026-11-03T09:17:11+00:00","first_seen_at":"2026-11-03T09:19:51+00:00","fetched_at":"2026-11-03T09:19:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}