CVE-2026-82279
HyperDX Team Management Operations Missing Role-Based Access Control
- State
- Published
- Severity
- 7.2 High
- Published
- Aug 28, 2026
- Updated
- Sep 24, 2026
- Reserved
- Aug 28, 2026
Description
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.2 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
hyperdxhyperdxio |
|
References
- GitHub Issue #2587issue-tracking
- https://github.com/hyperdxio/hyperdxproduct
- Vulnerable code: team.tstechnical-description
- VulnCheck Advisory: HyperDX Team Management Operations Missing Role-Based Access Controlthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.