CVE-2026-82279highCWE-862

HyperDX Team Management Operations Missing Role-Based Access Control

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.2epss 0.3%

probabilidad de explotación

0.3%top 76% de las CVE

explotación observada

noninguna fuente lo reporta

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

hyperdxio · hyperdx

Referencias

https://github.com/hyperdxio/hyperdx https://github.com/hyperdxio/hyperdx/blob/db6ee45feadb2e229bb234364b8661903f8e386e/packages/api/src/routers/api/team.ts https://github.com/hyperdxio/hyperdx/issues/2587 https://www.vulncheck.com/advisories/hyperdx-team-management-operations-missing-role-based-access-control