CVEvulnerability
CVE-2026-82279
7.2 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-08-28
- Last modified
- 2026-09-23
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 7.2 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Weaknesses
- CWE-862
Description
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://github.com/hyperdxio/hyperdx github.com
- https://github.com/hyperdxio/hyperdx/blob/db6ee45feadb2e229bb234364b8661903f8e386e/packages/api/src/routers/api/team.ts github.com
- https://github.com/hyperdxio/hyperdx/issues/2587 github.com
- https://www.vulncheck.com/advisories/hyperdx-team-management-operations-missing-role-based-access-control www.vulncheck.com
- https://github.com/hyperdxio/hyperdx/issues/2587 github.com