VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Jul 22, 2025· Updated Jun 17, 2026

CVE-2025-51479

CVE-2025-51479

Description

Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypassing intended curator-group assignment checks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Onyx Dot App/Onyx2 versions
    cpe:2.3:a:onyx:onyx:0.27.0:*:*:*:enterprise:*:*:*+ 1 more
    • cpe:2.3:a:onyx:onyx:0.27.0:*:*:*:enterprise:*:*:*
    • (no CPE)range: <0.27.0
  • onyx-dot-app/Onyx Enterprise Editiondescription
  • Onyx Dot App/Onyx Enterprise Editionllm-create
    Range: <0.27.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.