CVE-2026-42277 Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files

Medium 6.5 Published 8 May 2026 Updated 8 May 2026

Authenticated users can download other users' files by guessing UUIDs due to missing ownership checks in the file download endpoint.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-42277?

CVE-2026-42277 is a medium-severity missing authorization vulnerability in onyx-dot-app onyx, published on 8 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the GET /chat/file/{file_id} endpoint allows any authenticated user to download any other user's uploaded files by providing the file UUID. The endpoint verifies the caller is authenticated but never checks that the file belongs to them. An attacker who knows or obtains a file UUID can access confidential documents, chat attachments, and other files uploaded by any user in the system. This issue has been patched in versions 3.0.9, 3.1.6, and 3.2.6.

Weakness: CWE-639

Which versions are affected by CVE-2026-42277?

It affects 1 product.

Products include Onyx Onyx.

How do I fix CVE-2026-42277?

No fix has been published for CVE-2026-42277 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-42277 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42277 exists.

Sources

Also known as GHSA-vg3h-35f7-7w6r.