CVE-2026-28217

Received Received - Intake

IDOR in Hoppscotch GraphQL Allows Unauthorized Collection Access

Publication date: 2026-02-26

Last updated on: 2026-02-27

Assigner: GitHub, Inc.

Description

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized `data` field containing HTTP requests with headers and potentially secrets — to any authenticated user, without verifying that the requesting user owns the collection. This is an Insecure Direct Object Reference (IDOR) caused by a missing authorization check that exists on every other operation in the same resolver. Version 2026.2.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-26

Last Modified

2026-02-27

Generated

2026-07-06

AI Q&A

2026-02-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-28217

EUVD

EUVD-2026-8914

Affected Vendors & Products

Vendor	Product	Version / Range
hoppscotch	hoppscotch	to 2026.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Mitigation Strategies

To mitigate this vulnerability, upgrade hoppscotch to version 2026.2.0 or later, as this version fixes the issue by adding the missing authorization check.

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the hoppscotch API development ecosystem prior to version 2026.2.0. Specifically, the `userCollection` GraphQL query accepts any collection ID and returns the full collection data—including sensitive information like HTTP request headers and potentially secrets—to any authenticated user without verifying ownership of the collection. This missing authorization check allows users to access collections they do not own.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive data. Since the `userCollection` query returns full collection data including HTTP request headers and potentially secrets, an attacker or unauthorized user with valid authentication could access confidential information belonging to other users. This could compromise security by exposing API keys, tokens, or other sensitive request data.

Compliance Impact

I don't know

Detection Guidance

I don't know

Hi! I’m here to help you understand CVE-2026-28217. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70