CyberRota Analysis
AI-GeneratedHyperDX versions up to 1.10.1 are vulnerable due to inadequate enforcement of role-based access controls in team management endpoints, enabling any team member to execute administrative actions. This flaw allows unauthorized users to delete team members, rotate API keys, and rename teams, posing a significant risk to organizational security and data integrity. Organizations using HyperDX should prioritize addressing this vulnerability to prevent potential exploitation by malicious insiders or external attackers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.