HyperDX team route privilege escalation: member can delete admins, rotate API keys, rename team

Vulnerability Overview Title: Any team member can delete other members, rotate the API key, and rename the team ID: #2587 Status: Open Labels: external Reporter: geo-chen (reported on June 1, 2026) Core Issue: The HyperDX team management routes ( ) lack ownership or role-based validation for three sensitive operations (deleting members, rotating the API key, and renaming the team). This allows any authenticated user to permanently remove other users (including administrators), rotate the shared API key, and rename the team. Impact Regular team members can permanently remove other users (including administrators) from the instance, and the original administrator cannot restore access rights. Rotating the team API key breaks all automated integrations relying on this key (Alerts, CI/CD, external dashboards, etc.). In a shared observability instance, a single compromised or malicious user can cause loss of availability and integrity for the entire team. This defect is a design flaw (oversight), not an intentional design choice. Fix Add ownership or role-based validation to the three sensitive operations in the routes: 1. : Only allow the owner or a role with admin privileges to invoke . 2. : Only allow the owner or a role with admin privileges to invoke . 3. : Only allow the owner or a role with admin privileges to invoke . In the controller, should verify that the caller is the owner or holds the appropriate role, preventing cross-team deletions. In the model, the field should be used to control team management operations, rather than relying solely on or . POC Code

Goal Reached Thanks to every supporter — we hit 100%!

HyperDX team route privilege escalation: member can delete admins, rotate API keys, rename team

More from this source