CVE-2026-28217

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized `data` field containing HTTP requests with headers and potentially secrets — to any authenticated user, without verifying that the requesting user owns the collection. This is an Insecure Direct Object Reference (IDOR) caused by a missing authorization check that exists on every other operation in the same resolver. Version 2026.2.0 fixes the issue.

• CWE-862
• CWE-639

• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0Product, Release Notes
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-m5pg-r4jp-qq75Exploit, Mitigation, Vendor Advisory

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28211The NVDA Dev & Test Toolbox is an NVDA add-on for gathering …7.8
• CVE-2026-28212Firebird is an open-source relational database management sy…7.5
• CVE-2026-28213EverShop is a TypeScript-first eCommerce platform. Versions …9.8
• CVE-2026-28214Firebird is an open-source relational database management sy…6.5
• CVE-2026-28215hoppscotch is an open source API development ecosystem. Prio…9.1
• CVE-2026-28216hoppscotch is an open source API development ecosystem. Prio…8.3
• CVE-2026-28218Discourse is an open source discussion platform. Prior to ve…5.4
• CVE-2026-28219Discourse is an open source discussion platform. Prior to ve…4.3
• CVE-2026-2822A security vulnerability has been detected in JeecgBoot up t…8.8
• CVE-2026-28220Wazuh is a free and open source platform used for threat pre…9.1
• CVE-2026-28221Wazuh is a free and open source platform used for threat pre…8.2
• CVE-2026-28222Wagtail is an open source content management system built on…6.1