{"affected":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"AxxonNet","source":"CNA: AxxonSoft","vendor":"AxxonSoft","versions":[{"lessThan":"3.28.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-121024","cwes":["CWE-863"],"description":"Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.4,"severity":"medium","source":"CNA: AxxonSoft","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},{"score":5.3,"severity":"medium","source":"CNA: AxxonSoft","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793695690853,"publishedAt":1793695690853,"references":[{"source":"CNA: AxxonSoft","tags":["vendor-advisory"],"url":"https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121024"}],"remediation":[{"kind":"fix","source":"CNA: AxxonSoft","text":"Upgrade AxxonNet to version 3.28.0 or later. Revoke and reissue shared report tokens that were distributed before the upgrade, and review the monitoring alert configuration for unauthorized changes."}],"revision":"9ccdf1e35b57dcd139d45b4c3a205a6be693a8859201239a7c20bf06f18af378","sources":[{"modifiedAt":1793695690853,"name":"CNA: AxxonSoft","retrievedAt":1793696926524,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121024"}],"ssvc":null,"status":"published","title":"Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet","updatedAt":1793696926524}