CVE-2026-63178mediumCWE-639

CVE-2026-63178: falha de média gravidade em onyx-dot-app onyx

Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar onyx

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.5%
Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints in ee/onyx/server/user_group/api.py call update_user_group and add_users_to_user_group in ee/onyx/db/user_group.py without enforcing _validate_curator_can_modify_group, allowing a curator to add accounts to arbitrary groups and obtain document access through get_acl_for_user and the OpenSearch access_control_list filter. This issue is fixed in version 4.3.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
onyx-dot-app · onyx
CVEs relacionadas — onyx-dot-app onyx

No mesmo produto, das mais perigosas para as menos.

CVE-2026-85700HIGHOnyx 4.6.6 Custom Tool Secret Header Disclosure via Tool EndpointsEPSS 0.5%CVE-2026-71424CRITICALOnyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP serversEPSS 0.5%CVE-2026-42276MEDIUMOnyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessionsEPSS 0.3%CVE-2026-42277MEDIUMOnyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users filesEPSS 0.2%