CVE-2026-63178Medium· 6.5▾ Sunlit

Onyx is an open-source AI platform

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score36/ 100 · Low

impact 35.8 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 17, 2026

Updated

Sep 18, 2026

CVSS

6.5

Vendor

—

Product

—

CWE

CWE-639

Depth score

36 · Low

EPSS

0.52% · p44

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Sep 18.

0.3% → 0.5%▲ 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 39 days

Aug 17, 2026Published
Disclosed via NVD
Sep 18, 2026Record revised
Last analysed / modified upstream
Sep 18, 2026EPSS first tracked
0.3%
Sep 25, 2026EPSS peak
0.3% → 0.5%

CWE-639 #nvd

Full technical detail▾

Overview

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints in ee/onyx/server/user_group/api.py call update_user_group and add_users_to_user_group in ee/onyx/db/user_group.py without enforcing _validate_curator_can_modify_group, allowing a curator to add accounts to arbitrary groups and obtain document access through get_acl_for_user and the OpenSearch access_control_list filter. This issue is fixed in version 4.3.0.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed