{"id":"CVE-2026-121024","title":"Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet","summary":"Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-863"],"vendor":"AxxonSoft","product":"AxxonNet","affected":["AxxonNet < 3.28.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T20:18:02.836202Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T20:18:16.710Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121024","references":[{"url":"https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121024"}],"tags":["cve.org"],"epss":0.00207,"epssPercentile":0.1082,"ingestedAt":"2026-11-05T20:33:06.441Z","slug":"CVE-2026-121024","body":"## Overview\n\nIncorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.\n\n## Affected\n\n- `AxxonNet < 3.28.0`\n\n## Remediation\n\nUpgrade AxxonNet to version 3.28.0 or later. Revoke and reissue shared report tokens that were distributed before the upgrade, and review the monitoring alert configuration for unauthorized changes.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}