CVE-2026-42276CWE-639

Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions

Medium · published May 8, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/{chat_session_id} endpoint lets any authenticated user stop any other user's active chat session. The endpoint checks authentication but never verifies the session belongs to the caller. An attacker who knows a chat session UUID can kill another user's LLM generation mid-stream. This issue has been patched in versions 3.0.9, 3.1.6, and 3.2.6.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-08T03:49Z
EPSS history
Timeline
  • 08 MAY 03:49Z
    Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
    cvelistv5