CVE-2026-82279: Missing Authorization in hyperdxio hyperdx

HyperDX versions up to and including 1.10.1 fail to enforce role-based access controls on team management API endpoints. As a result, any authenticated team member can send requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints to perform administrative actions that should be restricted. This includes deleting team members (even owners), rotating API keys, and renaming teams. The vulnerability has a CVSS 4.0 base score of 7.2, indicating a high severity due to network attack vector, low attack complexity, no user interaction, and high impact on integrity and availability.

An attacker with team member privileges can escalate their control by deleting other members including owners, rotating API keys, and renaming teams, potentially disrupting team operations and compromising security controls. This could lead to unauthorized administrative changes within the affected HyperDX environment.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict team membership to trusted users only and monitor for unusual administrative actions.