Description
Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.
Published: 2026-11-03
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade AxxonNet to version 3.28.0 or later. Revoke and reissue shared report tokens that were distributed before the upgrade, and review the monitoring alert configuration for unauthorized changes.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 09:00:00 +0000

Type Values Removed Values Added
Description Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.
Title Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: AxxonSoft

Published:

Updated: 2026-11-03T08:48:10.853Z

Reserved: 2026-11-03T08:40:19.154Z

Link: CVE-2026-121024

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-03T09:17:12.337

Modified: 2026-11-03T15:54:01.657

Link: CVE-2026-121024

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T10:30:13Z

Weaknesses