Sensitive Information Exposure in AxxonSoft Axxon One on Windows and Linux
CVE-2026-121020

5.3MEDIUM

Key Information:

Vendor

Axxonsoft

Status
Axxon One
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121020?

AxxonSoft Axxon One prior to version 3.2.0 is susceptible to a vulnerability that allows remote authenticated users with limited privileges to access sensitive information. The security configuration API leak enables these users to enumerate all user accounts and roles configured in the system, revealing complete lists of users and roles without regard to their permissions. This flaw can lead to unauthorized visibility into user accounts, posing a risk to system integrity.

Affected Version(s)

Axxon One Windows 0 < 3.2.0

References

https://www.axxonsoft.com/legal/axxonsoft-vulnerability-d...
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Reported by a customer's information security team.
.