CVE-2026-28217: IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the userCollection GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized data field containing HTTP requests with headers and potentially secrets — to any authenticated user, without verifying that the requesting user owns the collection. This is an Insecure Direct Object Reference (IDOR) caused by a missing authorization check that exists on every other operation in the same resolver. Version 2026.2.0 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28217?
CVE-2026-28217 has been rated as a critical vulnerability due to its potential to expose sensitive user data.
How do I fix CVE-2026-28217?
To fix CVE-2026-28217, update to version 2026.2.0 or later of the hoppscotch application.
What type of vulnerability is CVE-2026-28217?
CVE-2026-28217 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the GraphQL userCollection query.
What data is exposed by CVE-2026-28217?
CVE-2026-28217 allows unauthorized access to other users' private collections, including titles and types.
Which versions of hoppscotch are affected by CVE-2026-28217?
CVE-2026-28217 affects all versions of hoppscotch prior to 2026.2.0.