AxonHub versions up to 1.0.0-beta11 contain a privilege escalation flaw in the handling of service account API keys. The system fails to validate the scopes assigned to these keys, enabling users with the write_api_keys permission to mint keys that include system-level scopes. An attacker can then use those keys to query the /admin/graphql endpoint and read the configuration of every channel, exposing base URLs and model lists, effectively gaining full visibility and control over the platform.

The vulnerability affects the AxonHub product run by looplj, specifically all deployments using version 1.0.0-beta11 or earlier. No other product versions or vendors are listed as impacted.

The CVSS score of 5.3 indicates a medium severity impact. Exploitation requires an attacker to be a project user with the ability to create service account keys, meaning the attack vector is authenticated user actions. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread, automated exploitation is not currently observed. Nonetheless, the ability to elevate privileges and read critical configuration warrants prompt remediation.