Medium severity5.4NVD Advisory· Published Jul 22, 2025· Updated Jun 17, 2026
CVE-2025-51479
CVE-2025-51479
Description
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypassing intended curator-group assignment checks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4<0.27.0+ 1 more
- (no CPE)range: <0.27.0
- cpe:2.3:a:onyx:onyx:0.27.0:*:*:*:enterprise:*:*:*
<0.27.0+ 1 more
- (no CPE)range: <0.27.0
- (no CPE)
Patches
Vulnerability mechanics
References
2- github.com/onyx-dot-app/onyx/pull/4714nvdExploitIssue Tracking
- www.gecko.security/blog/cve-2025-51479nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.