CVE-2025-51479 Missing authorization in n/a
Authenticated attackers can bypass authorization checks to modify arbitrary user groups in Onyx Enterprise Edition via crafted API requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-51479?
CVE-2025-51479 is a medium-severity missing authorization vulnerability in n/a, published on 22 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypassing intended curator-group assignment checks.
Weakness: CWE-639
Which versions are affected by CVE-2025-51479?
It affects 1 product.
Products include Onyx Onyx.
How do I fix CVE-2025-51479?
No fix has been published for CVE-2025-51479 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-51479 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-51479 exists.
Other vulnerabilities in n/a
- CVE-2026-42277 Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
- CVE-2024-7767 Improper Access Control in danswer-ai/danswer
- CVE-2024-9612 Unauthorized Access in danswer-ai/danswer
- CVE-2025-7894 Onyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injection
- CVE-2026-42276 Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
Sources
Also known as GHSA-4v78-j8g9-rpv2.