The flaw allows an authenticated curator to modify any user group’s membership without enforcing proper validation. By adding arbitrary users to a group, the attacker can obtain access to documents that belong to that group, effectively bypassing the intended access controls. This is an example of privilege escalation causing potential data exposure.

The vulnerability affects Onyx Enterprise Edition, any instance running a version earlier than 4.3.0. It concerns the PATCH /manage/admin/user-group/{id} and POST /manage/admin/user-group/{id}/add-users endpoints exposed in ee/onyx/server/user_group/api.py and ee/onyx/db/user_group.py.

The CVSS score of 6.5 indicates a medium severity risk. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Based on the description, the stated attack vector is local or remote execution with an authenticated curator role. An attacker with curator privileges could exploit the unprotected endpoints to elevate privileges and gain cross‑group document disclosure. The overall threat level is moderate, but remediation is advised promptly to prevent data leaks.