CVE-2026-63178

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/usergroupid and POST /manage/admin/user-group/usergroupid/add-users endpoints in ee/onyx/server/usergroup/api.py call updateusergroup and adduserstousergroup in ee/onyx/db/usergroup.py...

CVE-2026-63178 Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/usergroupid and POST /manage/admin/user-group/usergroupid/add-users endpoints in ee/onyx/server/usergroup/api.py call updateusergroup and adduserstousergroup in ee/onyx/db/usergroup.py...

EUVD-2026-60497

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/usergroupid and POST /manage/admin/user-group/usergroupid/add-users endpoints in ee/onyx/server/usergroup/api.py call updateusergroup and adduserstousergroup in ee/onyx/db/usergroup.py...

CVE-2026-63178 Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/usergroupid and POST /manage/admin/user-group/usergroupid/add-users endpoints in ee/onyx/server/usergroup/api.py call updateusergroup and adduserstousergroup in ee/onyx/db/usergroup.py...

PT-2026-76835

Name of the Vulnerable Software and Affected Versions Onyx Enterprise Edition versions prior to 4.3.0 Description In the Enterprise Edition of the Onyx AI platform, the endpoints 'PATCH /manage/admin/user-group/user group id' and 'POST /manage/admin/user-group/user group id/add-users' call the...