Hyperdx
Monthly
Missing authorization controls in HyperDX through 1.10.1 allow any authenticated team member to perform privileged administrative actions across team management endpoints. Three API endpoints - PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member - fail to enforce role-based access controls, enabling a low-privileged team member to rotate API keys, rename teams, and delete any team member including account owners. No public exploit has been identified at time of analysis, but the attack surface is straightforward given the explicit endpoint enumeration in the disclosure.
Missing authorization controls in HyperDX through 1.10.1 allow any authenticated team member to perform privileged administrative actions across team management endpoints. Three API endpoints - PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member - fail to enforce role-based access controls, enabling a low-privileged team member to rotate API keys, rename teams, and delete any team member including account owners. No public exploit has been identified at time of analysis, but the attack surface is straightforward given the explicit endpoint enumeration in the disclosure.