CVE-2025-51479 Details
Description
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypassing intended curator-group assignment checks.
A vulnerability allowing authorization bypass has been identified in Onyx Enterprise Edition version 0.27.0. This issue arises in the group management API, where curators are supposed to manage only the groups they are assigned to. However, the PATCH endpoint for user group management fails to validate permissions, allowing curators to modify any user group arbitrarily. The vulnerability is rooted in the 'update_user_group' function, which does not check if the authenticated user has the right to alter a specific group, thereby enabling unauthorized access and manipulation.
The vulnerability has been addressed in a recent commit by adding the necessary authorization checks to the group management API. Users should update to the latest version of Onyx Enterprise Edition to mitigate this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/onyx-dot-app/onyx | [email protected] | Product |
| https://github.com/onyx-dot-app/onyx/pull/4714 | [email protected] | ExploitIssue Tracking |
| https://www.gecko.security/blog/cve-2025-51479 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| onyx onyx | 0.27.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2025 | Initial Analysis | [email protected] |
| Jul 22, 2025 | CVE Modified | CISA-ADP |
| Jul 22, 2025 | New CVE Received | [email protected] |