The vulnerability allows any authenticated user to download any other user’s uploaded files by requesting the file UUID through the GET /chat/file/{file_id} endpoint. The request only verifies the caller is authenticated but never checks that the file belongs to the caller, enabling a classic IDOR that can expose sensitive documents and chat attachments.

The issue affects the Onyx open‑source AI platform produced by onyx-dot-app. Versions prior to 3.0.9, 3.1.6 and 3.2.6 are vulnerable, including all 3.0.x releases up to 3.0.8, all 3.1.x releases up to 3.1.5 and all 3.2.x releases up to 3.2.5.

The CVSS score of 6.5 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of an ownership check means an authenticated user who knows or discovers a file UUID can download any file. This makes exploitation straightforward in environments where file identifiers are shared or guessable, allowing attackers to read confidential data.