EUVD-2026-67810
GHSA-gcxp-837c-3488
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid team member credentials
-
DeliveryAuthenticate to HyperDX API
-
ExploitSend DELETE /team/member to remove owner
-
ExecutionSend PATCH /team/apiKey to rotate API key
-
ImpactDisrupt integrations and lock out administrators
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires valid team membership credentials (any role - read-only members are sufficient) for the target HyperDX instance. There is no requirement for administrative or owner-level privileges within the team. The instance must be network-reachable from the attacker's position. Exploitation is limited by the requirement for a valid authenticated session, meaning fully unauthenticated external attackers cannot exploit this flaw without first obtaining team credentials through a separate means (phishing, credential stuffing, etc.). The vulnerable endpoints are PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member - exploitation does not depend on any non-default configuration setting. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) accurately reflects the risk profile: the flaw is network-reachable, requires no special attack conditions, and only a valid team membership credential. Integrity and availability impacts are both rated High - deletion of owner accounts can permanently lock legitimate administrators out of the team, and API key rotation breaks downstream integrations. The missing confidentiality impact is plausible if the rotated API key value is not returned to the caller, though that assumption is not independently confirmed from the available data. The score of 7.2 is appropriate for an authenticated-but-low-privilege flaw with no scope change. No KEV listing and no public POC reduce urgency slightly, but the explicit endpoint enumeration in the public GitHub issue disclosure substantially lowers attacker effort - no fuzzing or discovery is required. |
| Exploit ScenarioDerived | An attacker who is a low-privileged member of a HyperDX team (e.g., a read-only analyst or a former employee whose account was not revoked) sends an unauthenticated-equivalent DELETE request to /team/member targeting the team owner's account, removing the owner from the team. The attacker then issues a PATCH to /team/apiKey to rotate the API key, disrupting all downstream integrations and locking the legitimate owner out of remediation. No public exploit code has been identified at time of analysis, but the specific endpoint paths are publicly disclosed in the GitHub issue, eliminating any discovery barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Missing authorization controls in HyperDX through 1.10.1 allow any authenticated team member to perform privileged administrative actions across team management endpoints. Three API endpoints - PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member - fail to enforce role-based access controls, enabling a low-privileged team member to rotate API keys, rename teams, and delete any team member including account owners. No public exploit has been identified at time of analysis, but the attack surface is straightforward given the explicit endpoint enumeration in the disclosure.
RemediationAI
No vendor-released patch has been identified at time of analysis - the CPE bounds the affected range at through 1.10.1 but no confirmed fixed version appears in the disclosure. Organizations should monitor the HyperDX GitHub repository (https://github.com/hyperdxio/hyperdx) and the tracking issue (https://github.com/hyperdxio/hyperdx/issues/2587) for a patched release. As a compensating control, restrict network access to the HyperDX API to trusted internal networks or VPN only, reducing the pool of potential attackers to already-trusted personnel. Additionally, audit current team membership to remove any untrusted or unnecessary team members, since any member can abuse these endpoints. Rotate any HyperDX API keys that may have been compromised and review integrations using those keys. Note that network restriction does not remediate the underlying flaw - it only reduces the attack surface to insider threats.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HyperDX is an open-source observability platform (cpe:2.3:a:hyperdxio:hyperdx). The vulnerable logic resides in packages/api/src/routers/api/team.ts, where team management routes are exposed without authorization middleware that verifies the requesting user holds an administrative or owner role. The root cause is CWE-862 (Missing Authorization) - authentication is enforced (a session/token is required), but the application does not check whether the authenticated principal has sufficient privilege to execute the requested operation. This is a classic broken object-level or broken function-level authorization flaw: any valid team session can invoke owner-level mutations.
Know when Hyperdx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable with low complexity; PR:L because a valid team membership session is required; high integrity and availability from owner deletion and key rotation; no confidentiality impact per disclosed behavior.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.
Executive ViewAI
HyperDX versions through 1.10.1 lack authorization checks on critical team management APIs, allowing any authenticated team member to rotate API keys, rename teams, and remove users including account owners. This creates insider threat exposure where employees can lock out colleagues and compromise API credentials used to access organizational data. Organizations using HyperDX should immediately audit team member access and monitor for suspicious administrative changes.
Implement comprehensive audit logging and alerting on team management API calls; restrict team member role assignment permissions to designated administrators only; enforce periodic access reviews and require approval workflows for any team role changes; establish API key rotation procedures and monitor for unexpected credential rotations; require multi-factor authentication for any account modifications; consider temporarily disabling self-service team management features until patching.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB