CVE-2026-82279
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.
Zwakheid
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.
Bronnen
- https://github.com/hyperdxio/hyperdx
- https://github.com/hyperdxio/hyperdx/blob/db6ee45feadb2e229bb234364b8661903f8e386e/packages/api/src/routers/api/team.ts
- https://github.com/hyperdxio/hyperdx/issues/2587
- https://www.vulncheck.com/advisories/hyperdx-team-management-operations-missing-role-based-access-control
- https://github.com/hyperdxio/hyperdx/issues/2587
Vind de bug voordat een aanvaller dat doet.
Log in met GitHub en start je eerste audit binnen een minuut. Voor het gratis abonnement is geen creditcard nodig.