HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.

HyperDX versions through 1.10.1 contain a missing role-based access control (RBAC) vulnerability in its team management API endpoints. Any authenticated team member can perform administrative actions without proper authorization checks. Affected endpoints include PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member. Exploitation allows attackers to delete team members including owners, rotate API keys, and rename teams. The vulnerability is tracked as CVE-2026-82279 and stems from insufficient authorization enforcement in the team router code. This poses significant risk to organizations using HyperDX for observability and log management. No privilege escalation is required beyond being a team member. The issue is documented in the HyperDX GitHub repository and reported via VulnCheck advisories.