Approved changes feed: RSS · Atom
cpe:2.3:a:onyx-dot-app:onyx:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Onyx Dot App (15a88af6-f2dc-552d-9c4c-6a9c3363f809) |
|---|---|
| Product | Onyx (f715e3a0-464e-5a25-baf2-0da58c1494b3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-42277 |
vulnerable | 2026-06-08 08:03:16.109789 |
Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
MEDIUM (6.5)
Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the GET /chat/file/{file_id} endpoint allows any authenticated user to download any other user's uploaded files by providing the file UUID. The endpoint verifies the caller is authenticated but never checks that the file belongs to them. An attacker who knows or obtains a file UUID can access confidential documents, chat attachments, and other files uploaded by any user in the system. This issue has been patched in versions 3.0.9, 3.1.6, and 3.2.6.
Published: 2026-05-08T03:51:11.520Z
Updated: 2026-05-08T21:28:14.132Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42276 |
vulnerable | 2026-06-08 08:03:16.108580 |
Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
MEDIUM (4.3)
Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/{chat_session_id} endpoint lets any authenticated user stop any other user's active chat session. The endpoint checks authentication but never verifies the session belongs to the caller. An attacker who knows a chat session UUID can kill another user's LLM generation mid-stream. This issue has been patched in versions 3.0.9, 3.1.6, and 3.2.6.
Published: 2026-05-08T03:49:56.765Z
Updated: 2026-05-08T12:57:18.681Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.