CVE-2026-63178: Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure
Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{usergroupid} and POST /manage/admin/user-group/{usergroupid}/add-users endpoints in ee/onyx/server/usergroup/api.py call updateusergroup and adduserstousergroup in ee/onyx/db/usergroup.py without enforcing validatecuratorcanmodifygroup, allowing a curator to add accounts to arbitrary groups and obtain document access through getaclforuser and the OpenSearch accesscontrollist filter. This issue is fixed in version 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Onyx Enterprise Editionto a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63178?
The severity of CVE-2026-63178 is medium, with a score of 6.5.
How do I fix CVE-2026-63178?
To fix CVE-2026-63178, update to Onyx Enterprise Edition version 4.3.0 or later.
What impact does CVE-2026-63178 have on Onyx users?
CVE-2026-63178 allows any curator to modify membership of arbitrary user groups, leading to potential cross-group document disclosure.
Are all versions of Onyx affected by CVE-2026-63178?
Yes, all versions prior to Onyx Enterprise Edition 4.3.0 are affected by CVE-2026-63178.
What kind of attacks can CVE-2026-63178 facilitate?
CVE-2026-63178 can facilitate unauthorized access to documents by allowing modifications to user group memberships.