Insecure Direct Object Reference in Hoppscotch API Development Environment
CVE-2026-28217

6.5MEDIUM

Key Information:

Vendor

Hoppscotch

Status
Hoppscotch
Vendor
CVE Published:
26 February 2026

What is CVE-2026-28217?

The Hoppscotch API development ecosystem features a vulnerability where the userCollection GraphQL query allows any authenticated user to access full collection data using an arbitrary collection ID. This includes sensitive information such as titles, types, and serialized HTTP request data. The absence of a necessary authorization check enables this exposure, making it critical for users to upgrade to version 2026.2.0, where the issue has been addressed.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

hoppscotch < 2026.2.0

References

https://github.com/hoppscotch/hoppscotch/security/advisor...
x_refsource_CONFIRM
https://github.com/hoppscotch/hoppscotch/releases/tag/202...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.