PT-2026-83302 · Hyperdx · Hyperdx
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
HyperDX versions prior to 1.10.2
Description
Failure to enforce role-based access controls in team management endpoints allows any team member to perform administrative actions. This can be exploited by sending requests to the following API endpoints:
- 'PATCH /team/apiKey' to rotate API keys
- 'PATCH /team/name' to rename teams
- 'DELETE /team/member' to delete team members, including owners
Recommendations
Update HyperDX to version 1.10.2 or later.
Restrict access to the 'PATCH /team/apiKey', 'PATCH /team/name', and 'DELETE /team/member' endpoints to authorized administrators only.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Hyperdx