Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the hoppscotch API development ecosystem prior to version 2026.2.0. Specifically, the `userCollection` GraphQL query accepts any collection ID and returns the full collection data—including sensitive information like HTTP request headers and potentially secrets—to any authenticated user without verifying ownership of the collection. This missing authorization check allows users to access collections they do not own.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade hoppscotch to version 2026.2.0 or later, as this version fixes the issue by adding the missing authorization check.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive data. Since the `userCollection` query returns full collection data including HTTP request headers and potentially secrets, an attacker or unauthorized user with valid authentication could access confidential information belonging to other users. This could compromise security by exposing API keys, tokens, or other sensitive request data.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0