CVE-2026-63178 onyx-dot-app CVE debrief

Who should care

Defenders and administrators of Onyx Enterprise Edition deployments should assess exposure and prioritize verification, especially where curators have elevated access. They should verify exposure in Onyx Enterprise Edition deployments, assess the impact of adding accounts to arbitrary groups on document access, and prioritize upgrading to version 4.3.0 or later to apply the fix.

Why it matters

CVE-2026-63178 allows curators to add accounts to arbitrary groups in Onyx Enterprise Edition, potentially leading to unauthorized document access. Defenders should prioritize verifying exposure, especially in deployments with elevated curator access, and upgrade to version 4.3.0 or later.

• Potential unauthorized document access through elevated group membership.
• Need to verify exposure in Onyx Enterprise Edition deployments.
• Prioritize upgrading to version 4.3.0 or later to apply the fix.
• Monitor user group management for potential misuse.

Technical summary

CVE-2026-63178 affects Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints, allowing a curator to add accounts to arbitrary groups and potentially obtain document access through get_acl_for_user and OpenSearch access_control_list filter. The issue is fixed in version 4.3.0. This vulnerability allows curators to add accounts to arbitrary groups, potentially leading to unauthorized document access. The affected endpoints are in ee/onyx/server/user_group/api.py, and the issue is resolved in version 4.3.0.

Defensive priority

Defenders should prioritize verifying exposure in Onyx Enterprise Edition deployments, especially where curators have elevated access, and assess the impact of adding accounts to arbitrary groups.

Recommended defensive actions

• Verify Onyx Enterprise Edition deployments for exposure, especially where curators have elevated access.
• Assess the impact of adding accounts to arbitrary groups on document access.
• Upgrade to version 4.3.0 or later to apply the fix.
• Monitor user group management and document access for potential misuse.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. However, additional information on exploitation or specific impacts is limited. The issue is fixed in version 4.3.0. There is no evidence of public exploitation, but defenders should verify exposure in Onyx Enterprise Edition deployments, especially where curators have elevated access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.