Axxon One CVE-2026-121020

Requires a valid authenticated account with limited privileges on an Axxon One instance before version 3.2.0 (Windows or Linux); no administrative rights or user interaction are needed. The specific trigger is the user configuration request to the security configuration API, which returns the complete lists of users and roles regardless of the caller's permissions. Limiting factors: the attacker must first obtain or possess working credentials for a low-privilege account, and instances already upgraded to 3.2.0 are not affected. Impact is confined to disclosure of user and role inventory - no modification or service disruption is possible through this flaw.

This is a medium-severity information disclosure (CWE-200) that the signals consistently rate as a low-urgency, non-emergency item rather than a top priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score agree on low technical impact: only confidentiality is affected (VC:L) with no integrity or availability impact, and exploitation requires an already-authenticated low-privilege account (PR:L). The vuln.today priority Decision label is 'this_month', not act_now or emergency, which aligns with the limited impact. There is no CISA KEV listing and no EPSS score supplied, so exploitation probability cannot be quantified from the input; status is therefore 'no public exploit identified at time of analysis'. The only cross-source caveat is a vendor-tag inconsistency (see data_quality_flags) - the product is tagged 'Microsoft' although it is an AxxonSoft product that merely runs on Windows/Linux. Net: a real but low-urgency privilege/information-boundary flaw, best scheduled into normal patching, not treated as an actively-exploited emergency.

An attacker who already holds a valid but limited-privilege account in Axxon One (for example an operator-level or guest VMS user) issues the user configuration request to the security configuration API. The API returns the complete list of all users and roles regardless of the caller's permissions, giving the attacker a full account and role inventory useful for targeting further attacks. No public exploit code is identified in the provided data.