CVE-2026-63178 is an authorization bypass vulnerability in Onyx Enterprise Edition's user group management API. The affected endpoints PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users call internal functions to update user groups without enforcing the _validate_curator_can_modify_group check. This allows a curator-level user to add accounts to arbitrary groups, thereby obtaining document access through the get_acl_for_user function and the OpenSearch access_control_list filter. The vulnerability is fixed in Onyx version 4.3.0.

An attacker with curator privileges can bypass authorization controls to add users to arbitrary groups, potentially gaining unauthorized access to sensitive documents. This leads to confidentiality breaches but does not affect system availability. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges at the curator level, no user interaction, and high impact on confidentiality and integrity.

Upgrade Onyx Enterprise Edition to version 4.3.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is not explicitly stated but the vendor has fixed the issue in 4.3.0, so applying this official fix is recommended.