EUVD-2026-60497Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Curator role is a delegated operational privilege, not admin-equivalent, making PR:L more accurate than the vendor-assigned PR:H; no availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints in ee/onyx/server/user_group/api.py call update_user_group and add_users_to_user_group in ee/onyx/db/user_group.py without enforcing _validate_curator_can_modify_group, allowing a curator to add accounts to arbitrary groups and obtain document access through get_acl_for_user and the OpenSearch access_control_list filter. This issue is fixed in version 4.3.0.
AnalysisAI
Privilege escalation in Onyx Enterprise Edition (versions prior to 4.3.0) allows any authenticated curator to modify user groups outside their assigned scope, gaining unauthorized document access through the platform's OpenSearch access_control_list filter. The PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints relied solely on a role check confirming the caller held curator status somewhere in the system, but the underlying database functions update_user_group and add_users_to_user_group never invoked _validate_curator_can_modify_group to scope that access to specific groups. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold the CURATOR or GLOBAL_CURATOR role within an Onyx Enterprise Edition deployment (ENABLE_PAID_ENTERPRISE_EDITION_FEATURES=true). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N scores 6.5, but PR:H overstates the authentication barrier - curator is a delegated administrative role granted to operational users, not equivalent to full system-admin access, making the effective privilege bar closer to PR:L and the real exploitability meaningfully higher than the score implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Onyx Enterprise Edition version 4.3.0, which is the vendor-released patch confirmed by the GitHub release tag at https://github.com/onyx-dot-app/onyx/releases/tag/v4.3.0 and implemented via pull requests https://github.com/onyx-dot-app/onyx/pull/12525 and https://github.com/onyx-dot-app/onyx/pull/12549. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search p
Cross-user credential disclosure in Onyx (open-source AI platform) lets any low-privileged BASIC_ACCESS user retrieve an
NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cau
NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in the LDAP AAA component, where a us
NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in ipfilter, where improper ipfilter
Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. Rate
Credential disclosure in Onyx 4.6.6 allows any authenticated user to retrieve plaintext API keys and authorization heade
Onyx versions prior to 3.0.9, 3.1.6, and 3.2.6 expose an authorization bypass in the GET /chat/file/{file_id} endpoint t
SQL injection in Onyx Chat Interface allows authenticated remote attackers to manipulate database queries via the genera
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary Ja
Onyx versions before 3.0.9, 3.1.6, and 3.2.6 permit authenticated users to terminate any other user's active chat sessio
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. Rated high severity (CVSS 8.1), t
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today