CVE-2026-28217
IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized `data` field containing HTTP requests with headers and potentially secrets — to any authenticated user, without verifying that the requesting user owns the collection. This is an Insecure Direct Object Reference (IDOR) caused by a missing authorization check that exists on every other operation in the same resolver. Version 2026.2.0 fixes the issue.
| CWE | CWE-862 |
| Vendor | hoppscotch |
| Product | hoppscotch |
| Published | Feb 26, 2026 |
| Last Updated | Feb 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for hoppscotch hoppscotch
Be the first to know when new medium vulnerabilities affecting hoppscotch hoppscotch are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
hoppscotch / hoppscotch
< 2026.2.0