CVE-2026-121020 in Axxon One
Summary
by MITRE • 11/03/2026
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as CWE-200 represents a critical failure in access control logic within the security configuration API of AxxonSoft Axxon One versions prior to 3.2.0, affecting both Windows and Linux deployments. This flaw allows for the unauthorized exposure of sensitive information through improper restriction of information retrieval by an authenticated user. Specifically, the vulnerability resides in how the system handles requests related to user account enumeration and role assignment data. The core technical issue is a broken access control mechanism where the server-side validation fails to verify whether the requesting entity possesses sufficient privileges to view specific subsets of configuration data. Instead of enforcing granular permissions that restrict visibility based on the caller's assigned roles, the API endpoint returns complete lists of all configured users and their associated roles regardless of the requester's actual permission level. This indicates a lack of object-level or attribute-level access control checks during the processing of user configuration requests.
From an operational perspective, this vulnerability enables any authenticated user with even minimal privileges to perform comprehensive reconnaissance against the target system. By enumerating all user accounts and their corresponding roles, an attacker can map out the entire organizational structure within the Axxon One environment. This information is highly valuable for subsequent attack phases, as it reveals high-privilege accounts that may be targeted in credential stuffing or brute-force attacks. Furthermore, knowledge of role assignments allows attackers to identify which users have administrative capabilities, thereby facilitating privilege escalation attempts. The attacker can tailor their social engineering efforts by knowing the specific roles and responsibilities of different individuals within the organization. This level of visibility significantly lowers the barrier for further exploitation, as it provides a clear roadmap of potential targets and access paths that were previously obscured from lower-privileged users.
In terms of industry standards classification, this vulnerability aligns with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. It also maps closely to MITRE ATT&CK technique T1087.004: Account Enumeration on Cloud Accounts and potentially T1098.003: SSH Authorized Keys Modification if the enumerated data is used to facilitate further access, though primarily it serves as a precursor for lateral movement or privilege escalation. The flaw exemplifies a common pattern in web application security where API endpoints are designed without strict adherence to the principle of least privilege, assuming that authentication alone provides sufficient protection against information disclosure. This oversight highlights the necessity for rigorous input validation and authorization checks at every level of the application stack, particularly when handling sensitive configuration data.
To mitigate this vulnerability, organizations running Axxon One versions prior to 3.2.0 must apply the vendor-provided patch immediately upon availability. The update addresses the underlying access control logic in the security configuration API, ensuring that user enumeration requests are properly filtered based on the caller's permissions. In addition to applying the software update, administrators should review their current role-based access control policies to ensure they adhere to best practices for privilege separation. It is advisable to audit existing accounts and remove any unnecessary privileges granted to low-level users who do not require administrative or configuration management capabilities. Implementing multi-factor authentication for all user accounts can also reduce the risk associated with compromised credentials, although it does not directly fix the information disclosure flaw itself. Regular security assessments and penetration testing should be conducted to identify similar access control weaknesses in other API endpoints before they can be exploited by malicious actors.