Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure

published 2026-08-17 2 mo ago modified 2026-10-23 16 d ago also EUVD-2026-60497

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits: 0; none known

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints in ee/onyx/server/user_group/api.py call update_user_group and add_users_to_user_group in ee/onyx/db/user_group.py without enforcing _validate_curator_can_modify_group, allowing a curator to add accounts to arbitrary groups and obtain document access through get_acl_for_user and the OpenSearch access_control_list filter. This issue is fixed in version 4.3.0.

Patch / fix

links 5

github.com/onyx-dot-app/onyx@46e19cc commit
github.com/onyx-dot-app/onyx@b9e1c68 commit
github.com/onyx-dot-app/onyx#12525 pull request
github.com/onyx-dot-app/onyx#12549 pull request
github.com/onyx-dot-app/onyx/releases/tag/v4.3.0 release

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 2 mo ago (2026-08-18)

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-7f48-vgpj-h95m referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Affected products

onyx-dot-app onyx

Classification

Weakness

CWE-639 Authorization Bypass Through User-Controlled Key

References

Sources

CVE List CVE-2026-63178
NVD CVE-2026-63178

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary