What is GHSA-j27f-gvg7-cxpv?

GHSA-j27f-gvg7-cxpv is a security advisory published by GitHub Security Advisories with Medium severity. Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security...

Which CVE IDs does GHSA-j27f-gvg7-cxpv cover?

GHSA-j27f-gvg7-cxpv covers the following CVE IDs: CVE-2026-121020. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j27f-gvg7-cxpv?

GHSA-j27f-gvg7-cxpv has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-j27f-gvg7-cxpvMediumCVSS 4.3

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security...

Vendor

GitHub Security Advisories

Published

November 3, 2026

Last Modified

November 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-121020 →

📋 Description

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-121020
https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121020
https://github.com/advisories/GHSA-j27f-gvg7-cxpv