CVE-2026-42277 is an authorization bypass vulnerability in the onyx platform affecting versions before 3.0.9, between 3.1.0 and 3.1.6, and between 3.2.0 and 3.2.6. The GET /chat/file/{file_id} endpoint allows any authenticated user to retrieve files belonging to other users by providing the file UUID, as the endpoint lacks proper ownership verification. This flaw enables unauthorized disclosure of confidential documents and chat attachments. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). It has been patched in versions 3.0.9, 3.1.6, and 3.2.6.

An attacker with valid authentication can access confidential files uploaded by other users without authorization by exploiting the lack of ownership checks on the file download endpoint. This leads to unauthorized disclosure of sensitive information. The vulnerability does not affect system integrity or availability but compromises confidentiality.

The vulnerability has been addressed in onyx versions 3.0.9, 3.1.6, and 3.2.6. Users should upgrade to one of these versions or later to remediate the issue. Since this is not a cloud service, patching the affected software versions is required to mitigate the risk. Patch status is confirmed by the vendor's versioning information.