CVE-2026-63178

Name of the Vulnerable Software and Affected Versions Onyx Enterprise Edition versions prior to 4.3.0

Description In the Enterprise Edition of the Onyx AI platform, the endpoints 'PATCH /manage/admin/user-group/{user group id}' and 'POST /manage/admin/user-group/{user group id}/add-users' call the functions update user group() and add users to user group() without enforcing the validate curator can modify group check. This allows a user with curator privileges to add accounts to arbitrary groups, potentially gaining unauthorized document access via get acl for user() and the OpenSearch access control list filter.

Recommendations Update Onyx Enterprise Edition to version 4.3.0.