CVE-2025-51479
BaseFortify
Publication date: 2025-07-22
Last updated on: 2025-10-09
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| onyx | onyx | 0.27.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an authorization bypass in the update_user_group function of onyx-dot-app Onyx Enterprise Edition 0.27.0. It allows remote authenticated attackers to modify arbitrary user groups by sending specially crafted PATCH requests to the /api/manage/admin/user-group/id endpoint. This bypasses the intended checks that restrict curator-group assignments.
How can this vulnerability impact me? :
An attacker who exploits this vulnerability can change user group assignments without proper authorization. This could lead to unauthorized access or privilege escalation within the application, potentially compromising the security and integrity of user roles and permissions.