CVE-2026-63178Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints in ee/onyx/server/user_group/api.py call update_user_group and add_users_to_user_group in ee/onyx/db/user_group.py without enforcing _validate_curator_can_modify_group, allowing a curator to add accounts to arbitrary groups and obtain document access through get_acl_for_user and the OpenSearch access_control_list filter. This issue is fixed in version 4.3.0.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://secnora.com/blog/cve-2026-63178-onyx-curator-scope-idor/

Full discourse1 post

SECNORA®@secnorainfosec47d
Disclosure
🔒 CVE-2026-63178 (CVSS Score: 6.5): Onyx Curator-Scope IDOR Turns Group Membership Into a Backdoor Curators could rewrite membership of ANY group in the deployment, not just their own and inherit that group's documents in the process. 🔗 Read full blog: https://secnora.com/blog/cve-2026-63178-onyx-curator-scope-idor/
Post summary
The post announces the discovery of CVE‑2026‑63178, an IDOR flaw in Onyx Curator that allows unauthorized group membership changes, and provides basic technical details including the CVSS score.
0000033
75 followersView on X

Explore more

Back to dashboard