CVE-2026-121020

CVE-2026-121020

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.

Vulnerability class: Information Disclosure

Published · last modified .

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.002 (11.9th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 12th percentile — 11.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-121020?
CVE-2026-121020 is a medium-severity vulnerability, classified under Information Disclosure. CVSS score: 4.3/10. Published 2026-11-03.
How severe is CVE-2026-121020?
Medium severity. CVSS v3 base score is 4.3 out of 10.