Vulnerabilities in onyx-dot-app
6 resultsCVE-2026-63178MEDIUMOnyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosureEPSS 0.5%CVE-2026-85700HIGHOnyx 4.6.6 Custom Tool Secret Header Disclosure via Tool EndpointsEPSS 0.5%CVE-2026-71424CRITICALOnyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP serversEPSS 0.5%CVE-2026-42276MEDIUMOnyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessionsEPSS 0.3%CVE-2026-42277MEDIUMOnyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users filesEPSS 0.2%CVE-2026-116004MEDIUMonyx-dot-app Onyx PreviewTab.tsx cross site scriptingEPSS 0.2%