CVE-2026-82279CWE-862broken-access-control

CVE-2026-82279

High · published August 29, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
25.1
In the wild
Unconfirmed
What it is

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
7.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00331 · 25.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-29T00:20Z
References (5)
https://github.com/hyperdxio/hyperdx · [email protected]https://github.com/hyperdxio/hyperdx/blob/db6ee45feadb2e229bb234364b8661903f8e386e/packages/api/src/routers/api/team.ts · [email protected]https://github.com/hyperdxio/hyperdx/issues/2587 · [email protected]https://www.vulncheck.com/advisories/hyperdx-team-management-operations-missing-role-based-access-control · [email protected]https://github.com/hyperdxio/hyperdx/issues/2587 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 16:18Z
    HyperDX Team Management Operations Missing Role-Based Access Control
    cvelistv5