An authenticated user with limited privileges can issue a request to the security configuration API of Axxon One and receive lists of all users and roles in the system. The response is not filtered by the caller’s permissions, violating the confidentiality of account and role data. The flaw, classified as CWE‑200, allows an attacker to discover the full set of credentials and role assignments that could be leveraged for privilege escalation or targeted attacks. No injection or denial‑of‑service elements are present; the impact is strictly informational disclosure.

The affected product is AxxonSoft’s Axxon One Configuration Management System, deployed on Windows or Linux servers. Any installation running a version earlier than 3.2.0 is vulnerable. Updates released after 3.2.0 fix the enumeration issue by returning only data the caller is authorized to see.

This vulnerability has a CVSS score of 5.3, reflecting moderate exploitation potential. Because the flaw requires an authenticated session and no publicly known exploit exists, the EPSS score is not available and it is not listed in the CISA KEV catalog. The enumeration of users and roles is achievable only when the attacker possesses a low‑privilege authenticated session, a condition that is common during the initial stages of a compromise. Consequently, organizations should treat this exposure as a moderate risk that could facilitate other attacks.