CVE-2026-42277

medium

Published 2026-05-08 · Modified 2026-05-12

CVSS v3

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2

—

VIR risk

6.5

Description

Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the GET /chat/file/{file_id} endpoint allows any authenticated user to download any other user's uploaded files by providing the file UUID. The endpoint verifies the caller is authenticated but never checks that the file belongs to them. An attacker who knows or obtains a file UUID can access confidential documents, chat attachments, and other files uploaded by any user in the system. This issue has been patched in versions 3.0.9, 3.1.6, and 3.2.6.

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-vg3h-35f7-7w6r

Application impact

Vendor	Product	Versions	Fixed
onyx	onyx	`{"endExcluding":"3.0.9"}`	`3.0.9`

References

CWEs

CWE-639

Verify integrity in audit chain (admin only). AS-IS.