CVE-2026-28217

Katalog CVE

CVSS 6.5 · Medium EPSS 0,38%

Kerentanan Missing Authorization pada hoppscotch. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized `data` field containing HTTP requests with headers and potentially secrets — to any authenticated user, without verifying that the requesting user owns the collection. This is an Insecure Direct Object Reference (IDOR) caused by a missing authorization check that exists on every other operation in the same resolver. Version 2026.2.0 fixes the issue.

Rincian

Terbit di NVD

26 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-m5pg-r4jp-qq75 exploit · mitigasi · advisory vendor
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0 product · release notes