CVE-2026-28217 Details
Description
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized `data` field containing HTTP requests with headers and potentially secrets — to any authenticated user, without verifying that the requesting user owns the collection. This is an Insecure Direct Object Reference (IDOR) caused by a missing authorization check that exists on every other operation in the same resolver. Version 2026.2.0 fixes the issue.
A vulnerability exists in Hoppscotch prior to version 2026.2.0, specifically within the GraphQL userCollection query. This query allows any authenticated user to access full collection data, including titles, types, and serialized HTTP requests with headers and potentially sensitive information, such as secrets. The vulnerability arises from a missing authorization check, enabling Insecure Direct Object Reference (IDOR) exploitation. While other operations in the same resolver include ownership verification, the userCollection query does not, leading to unauthorized data access.
Users can upgrade to Hoppscotch version 2026.2.0 or later, where this vulnerability has been fixed. After upgrading, self-hosted users should run the latest database migrations.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0 | [email protected] | ProductRelease Notes |
| https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-m5pg-r4jp-qq75 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hoppscotch hoppscotch | < 2026.2.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 27, 2026 | Initial Analysis | [email protected] |
| Feb 26, 2026 | New CVE Received | [email protected] |