PT-2026-22212 · Unknown · Hoppscotch

Bugbunny-Research · Published 2026-02-26 · Updated 2026-02-27 · CVE-2026-28217

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions hoppscotch versions prior to 2026.2.0

Description The userCollection GraphQL query in hoppscotch does not verify ownership before returning collection data, including potentially sensitive information like HTTP requests and headers, to authenticated users. This is an Insecure Direct Object Reference (IDOR) issue stemming from a missing authorization check. The query accepts an arbitrary collection ID and returns the full collection data to any authenticated user, regardless of ownership.

Recommendations Update to version 2026.2.0 or later.

Exploit

Fix

Missing Authorization

IDOR

Weakness Enumeration

CWE-862

CWE-639

Related Identifiers

CVE-2026-28217

GHSA-M5PG-R4JP-QQ75

Affected Products

Hoppscotch

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28217.json · Exploit
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-m5pg-r4jp-qq75 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28217 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28217 · Vendor Advisory
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0 · Note
• https://twitter.com/CVEnew/status/2027466637163827561 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027198255344320707 · Twitter Post