CVE-2026-63178 Overview
CVE-2026-63178 is an authorization flaw in Onyx, an open-source AI platform. Onyx Enterprise Edition versions prior to 4.3.0 fail to enforce curator scope validation on two user-group management endpoints. A curator can add arbitrary accounts, including their own, to any user group and inherit that group's document access rights through the OpenSearch access_control_list filter. The issue is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key] and is fixed in Onyx 4.3.0.
Critical Impact
An authenticated curator can escalate privileges and read documents outside their assigned scope by manipulating user-group membership.
Affected Products
- Onyx Enterprise Edition versions prior to 4.3.0
- ee/onyx/server/user_group/api.py PATCH /manage/admin/user-group/{user_group_id} endpoint
- ee/onyx/server/user_group/api.py POST /manage/admin/user-group/{user_group_id}/add-users endpoint
Discovery Timeline
- 2026-08-17 - CVE-2026-63178 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-63178
Vulnerability Analysis
Onyx implements a curator role intended to manage a limited subset of user groups. The PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users handlers in ee/onyx/server/user_group/api.py invoke update_user_group and add_users_to_user_group from ee/onyx/db/user_group.py directly. Neither handler calls _validate_curator_can_modify_group before mutating group membership. As a result, the authorization check that restricts curators to their permitted groups is skipped on these code paths.
Document access in Onyx flows through get_acl_for_user, which builds an OpenSearch access_control_list filter based on the caller's group memberships. Once a curator has added their account to a privileged group, subsequent queries against the search index return documents belonging to that group. The flaw combines a missing authorization check with an ACL model that trusts group membership as the sole gate to document retrieval.
Root Cause
The root cause is a missing invocation of the _validate_curator_can_modify_group guard on two write endpoints. The database helpers assume upstream authorization has already been performed, so no defense-in-depth check exists at the data layer.
Attack Vector
An attacker requires valid curator credentials on an Onyx Enterprise deployment. The attacker sends an authenticated HTTP request to either affected endpoint referencing a user_group_id outside their curator scope, adding a controlled account to that group. Subsequent search queries return documents governed by the target group's ACL. Exploitation is remote and does not require user interaction.
See the GitHub Security Advisory GHSA-7f48-vgpj-h95m for the vendor description.
Detection Methods for CVE-2026-63178
Indicators of Compromise
- Unexpected PATCH requests to /manage/admin/user-group/{user_group_id} originating from accounts assigned the curator role.
- POST requests to /manage/admin/user-group/{user_group_id}/add-users where the target user_group_id is not within the caller's assigned curator scope.
- Audit-log entries showing curator accounts appearing as members of user groups they do not manage.
Detection Strategies
- Correlate application access logs with the Onyx role model to flag user-group modifications where the acting principal is a curator not authorized for the target group.
- Baseline the rate of add-users and group PATCH calls per curator account and alert on deviations.
- Review OpenSearch query patterns for curator sessions that suddenly retrieve documents outside their historical access footprint.
Monitoring Recommendations
- Forward Onyx application and audit logs to a centralized analytics platform and retain group-membership change events.
- Alert on any successful HTTP 200 response to the two affected endpoints when the caller's role is curator.
- Monitor authentication and session activity for curator accounts that begin issuing high-volume search queries after group changes.
How to Mitigate CVE-2026-63178
Immediate Actions Required
- Upgrade Onyx Enterprise Edition to version 4.3.0 or later.
- Audit user-group membership and remove any accounts added by curators outside their assigned scope.
- Rotate credentials and review search-index access logs for curator accounts active before the upgrade.
Patch Information
The fix is included in Onyx 4.3.0. See GitHub Release v4.3.0, GitHub Pull Request #12525, GitHub Pull Request #12549, and the underlying commits 46e19cc and b9e1c68. The patch adds _validate_curator_can_modify_group enforcement to both the PATCH and add-users handlers.
Workarounds
- Where an immediate upgrade is not possible, restrict the curator role to trusted administrators only.
- Place a reverse proxy or API gateway rule in front of Onyx that blocks curator accounts from calling /manage/admin/user-group/{user_group_id} and /manage/admin/user-group/{user_group_id}/add-users.
- Review and tighten group-based document ACLs so that sensitive corpora require additional attributes beyond group membership.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
