CVE-2026-82279highCWE-862

HyperDX Team Management Operations Missing Role-Based Access Control

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.3%

probabilidade de exploração

0.3%top 80% das CVEs

exploração observada

nãonenhuma fonte reporta

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

hyperdxio · hyperdx

Referências

https://github.com/hyperdxio/hyperdx https://github.com/hyperdxio/hyperdx/blob/db6ee45feadb2e229bb234364b8661903f8e386e/packages/api/src/routers/api/team.ts https://github.com/hyperdxio/hyperdx/issues/2587 https://www.vulncheck.com/advisories/hyperdx-team-management-operations-missing-role-based-access-control