HyperDX versions up to 1.10.1 have a missing role‑based access control check in team‑management endpoints. The application allows any authenticated team member to perform administrative actions such as deleting team members—including owners—rotating API keys, and renaming teams. This flaw can lead to loss of control over team resources, potential data exposure if API keys are misused, and disruption of team collaboration. The weakness corresponds to the CWE representing lack of authorization enforcement.

The vulnerability affects the HyperDX platform, specifically the team‑management functionality of version 1.10.1 and earlier. Users of HyperDX who rely on the current API endpoints for managing members, keys, and team names are impacted by this lack of RBAC. No other product versions are identified in the CVE data.

The CVSS score of 7.2 indicates a high severity, and the EPSS score is not available, which suggests limited current exploitation data but does not reduce the inherent risk. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by accessing any of the PATCH /team/apiKey, PATCH /team/name, or DELETE /team/member endpoints while authenticated as a team member. Because the flaw does not require elevated credentials and the requests are standard HTTP requests, the likely attack vector is an authorized insider or a compromised member account.