PT-2026-133551
CVE-2026-119599
·
Published
2026-10-30
·
Updated
2026-10-30
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service account API keys with unvalidated scopes. Attackers holding write api keys can mint keys with read channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾