CVE-2026-63178

Received Received - Intake

Privilege Escalation in Onyx Enterprise Edition

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints in ee/onyx/server/user_group/api.py call update_user_group and add_users_to_user_group in ee/onyx/db/user_group.py without enforcing _validate_curator_can_modify_group, allowing a curator to add accounts to arbitrary groups and obtain document access through get_acl_for_user and the OpenSearch access_control_list filter. This issue is fixed in version 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-63178

Affected Vendors & Products

Vendor	Product	Version / Range
onyx	enterprise_edition	to 4.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Onyx, an open-source AI platform. Before version 4.3.0, two specific API endpoints in the Enterprise Edition allowed curators to add accounts to any user group without proper validation. This could let attackers gain unauthorized access to documents by manipulating group memberships.

Detection Guidance

This vulnerability can be detected by checking the Onyx Enterprise Edition version. If the version is below 4.3.0, the system is vulnerable. Commands to check the version may include inspecting package metadata or running version-specific API calls.

Impact Analysis

If you use Onyx Enterprise Edition before version 4.3.0, an attacker with curator access could add their account to any group, potentially accessing sensitive documents or data they should not have permission to view.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements for GDPR, HIPAA, or other regulations that mandate strict access controls and data protection measures.

Mitigation Strategies

Upgrade Onyx Enterprise Edition to version 4.3.0 or later to address the vulnerability in the user group management endpoints.

Hi! I’m here to help you understand CVE-2026-63178. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70