CVE-2026-63178

🗓️ 17 Aug 2026 21:30:40Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 42 Views🌐 WEB

Onyx IDOR lets curators modify arbitrary user groups, causing cross-group document disclosure.

Reporter	Title	Published	Views	Family All 7
attackerkb	CVE-2026-63178	17 Aug 202621:30	–	attackerkb
Cvelist	CVE-2026-63178 Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure	17 Aug 202621:30	–	cvelist
EUVD	EUVD-2026-60497	17 Aug 202621:30	–	euvd
NVD	CVE-2026-63178	17 Aug 202622:17	–	nvd
Positive Technologies	PT-2026-76835	17 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-63178: Authorization Bypass Through User-Controlled Key	17 Aug 202600:00	–	rapid7
Vulnrichment	CVE-2026-63178 Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure	17 Aug 202621:30	–	vulnrichment

Vulners

Node

onyx onyx-dot-appRange<4.3.0

[
  {
    "vendor": "onyx-dot-app",
    "product": "onyx",
    "versions": [
      {
        "version": "< 4.3.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/onyx-dot-app/onyx/releases/tag/v4.3.0
github	www.github.com/onyx-dot-app/onyx/pull/12549
github	www.github.com/onyx-dot-app/onyx/pull/12525
github	www.github.com/onyx-dot-app/onyx/security/advisories/GHSA-7f48-vgpj-h95m
github	www.github.com/onyx-dot-app/onyx/commit/b9e1c6894be3c237283f4b5fd4eb0af935b40664
github	www.github.com/onyx-dot-app/onyx/commit/46e19cc2750fed659488cb12a1f171016ba5a099

Parameter	Position	Path	Description	CWE
group_data	request body	/manage/admin/user-group/{user_group_id}	Privilege bypass: updating a user group without enforcing curator modification checks.	CWE-639
users_to_add	request body	/manage/admin/user-group/{user_group_id}/add-users	Privilege bypass: adding users to a group without enforcing curator modification checks and ACL validation.	CWE-639

18 Sep 2026 20:09Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.16.5

EPSS0.00516

SSVC

CWE-639