The vulnerability in onyx versions prior to 3.0.9, 3.1.6, and 3.2.6 allows any authenticated user to bypass authorization controls on the GET /chat/file/{file_id} endpoint. The endpoint checks only that the requester is authenticated but fails to confirm that the requested file belongs to the user. Consequently, an attacker who knows or guesses a file UUID can access other users' confidential files, including documents and chat attachments. This is classified as CWE-639: Authorization Bypass Through User-Controlled Key. The issue is resolved in versions 3.0.9, 3.1.6, and 3.2.6.

An attacker with valid authentication can access confidential files of other users by exploiting the lack of ownership verification on file retrieval. This leads to unauthorized disclosure of sensitive information. The vulnerability does not affect integrity or availability but compromises confidentiality. The CVSS v3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact.

This vulnerability has been patched in onyx versions 3.0.9, 3.1.6, and 3.2.6. Users should upgrade to at least these versions to remediate the issue. No additional mitigations are specified or required once patched. Patch status is confirmed by the vendor's versioning information.