Access Control Flaw in Onyx Enterprise Edition from Onyx

CVE-2026-63178

What is CVE-2026-63178?

Onyx Enterprise Edition includes an access control vulnerability that allows a curator to modify user group memberships without proper validation. This flaw, present in versions prior to 4.3.0, enables unauthorized users to add accounts to arbitrary groups and gain access to documents. It affects endpoints related to user group management, specifically the PATCH and POST methods, which do not adequately enforce permissions. The vulnerability has been addressed in version 4.3.0, providing necessary safeguards against unauthorized access.

References