---
id: "CVE-2026-121020"
kind: "vulnerability"
aliases: ["CVE-2026-121020"]
title: "AxxonSoft Axxon One: low-privilege users can list all accounts and roles"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["axxon-one", "infrastructure", "linux", "video-surveillance", "windows"]
not_affected_if: ["version-3.2.0-or-later"]
published_at: "2026-11-03T09:17:11+00:00"
first_seen_at: "2026-11-03T09:19:51+00:00"
updated_at: "2026-11-03T09:20:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121020", "first_seen_at": "2026-11-03T09:19:51+00:00"}]
---

# AxxonSoft Axxon One: low-privilege users can list all accounts and roles

Axxon One before 3.2.0 on Windows and Linux returns the complete list of user accounts and roles from its security configuration API, whatever the caller's permissions. A remote attacker with a limited-privilege account can enumerate every user and role on the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Axxon One version and confirm whether it is earlier than `3.2.0`

## Fix

- Axxon One: move to `3.2.0` or later

## Timeline

- 2026-11-03T09:19:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121020

## From the sources

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_