CVE-2026-121020
MediumCVSS 4.3Summary
Exposure of sensitive information to an unauthorized actor (CWE-200) in the security configuration API of AxxonSoft Axxon One before 3.2.0 allows a remote authenticated low-privileged user to enumerate all configured users and roles, because the user configuration request returned complete lists regardless of the caller's permissions.
Risk Assessment
Disclosure of the account and role inventory helps attackers map the environment and prepare targeted attacks, including against privileged accounts. It may violate least-privilege and confidentiality requirements.
Recommendation
Upgrade Axxon One to version 3.2.0 or later and review account permissions to restrict access to configuration data according to least privilege.
Other vulnerabilities in Axxon One
See all- CVE-2026-121022High
Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 allows a remote unauthenticated attacker to log in as the built-in administrator with default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.
- CVE-2026-121021Medium
Plaintext storage of a password (CWE-256) in the SecurityManager shared configuration of AxxonSoft Axxon One before 3.1.0 allows a local attacker with read access to the configuration directory or backups to obtain the LDAP service account password from the main.conf file.
- CVE-2025-10223Medium
Insufficient Session Expiration in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows an authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expiration.
Original NVD description (English source)
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS