CVE-2026-82279 | BDVDB-2026-366208 Detail
hyperdxiohyperdx
Description#
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-862 Missing Authorization
References#
- https://github.com/hyperdxio/hyperdx/issues/2587
- https://github.com/hyperdxio/hyperdx
- https://github.com/hyperdxio/hyperdx/blob/db6ee45feadb2e229bb234364b8661903f8e386e/packages/api/src/routers/api/team.ts
- https://www.vulncheck.com/advisories/hyperdx-team-management-operations-missing-role-based-access-control
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.