CVE-2026-28217: 
NixOS vulnerability analysis and mitigation

CVE-2026-28217 is an Insecure Direct Object Reference (IDOR) vulnerability in Hoppscotch, an open-source API development ecosystem. The userCollection GraphQL query accepts an arbitrary collection ID and returns full collection data — including HTTP request headers and stored secrets — to any authenticated user without verifying ownership. All versions prior to 2026.2.0 (i.e., ≤ 2026.1.1) of the self-hosted hoppscotch-backend Docker image are affected. The vulnerability was published on February 26, 2026, and patched in version 2026.2.0 released the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is a missing authorization check (CWE-862: Missing Authorization; CWE-639: Authorization Bypass Through User-Controlled Key) in the userCollection query resolver located in packages/hoppscotch-backend/src/user-collection/user-collection.resolver.ts (line 134). Unlike every other mutation and query in the same resolver — which inject @GqlUser() and call the private isOwnerCheck() method — the userCollection query only enforces authentication via GqlAuthGuard but never retrieves or validates the requesting user's identity against the collection's owner. The underlying service method getUserCollection() performs a bare findUniqueOrThrow({ where: { id: collectionID } }) with no userUid filter, meaning any valid collection ID is sufficient to retrieve the full record. Additionally, the parent, childrenREST, and childrenGQL field resolvers also lack ownership checks, enabling full collection tree traversal. A detailed proof-of-concept is included in the official security advisory (GitHub Advisory).

An authenticated attacker can enumerate and read any user's private collections by supplying arbitrary collection IDs in GraphQL queries, resulting in high confidentiality impact with no integrity or availability impact. The serialized data field within collections may contain HTTP request definitions including authorization headers, bearer tokens, API keys, and other secrets stored by users. The response also leaks the victim's user UID via the userID field, and the attacker can traverse the victim's entire collection hierarchy (parent, child REST, and child GraphQL collections) to achieve broad cross-tenant data exposure (GitHub Advisory).

A proof-of-concept GraphQL query is publicly documented in the official GitHub Security Advisory, making exploitation straightforward for any authenticated user. No special privileges beyond a valid user account are required, and no user interaction or complex chaining is needed. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.028% (0.000280), indicating low current exploitation probability (GitHub Advisory).

1. Authenticate: Obtain a valid JWT by logging into the target Hoppscotch instance with any standard user account.
2. Discover a collection ID: Identify a victim's collection ID (CUID format, e.g., clx1abc2d0001...) through shared/exported collection links, application logs, browser network traffic, or by brute-forcing the time-based CUID namespace.
3. Send the malicious GraphQL query: Issue a POST request to the /graphql endpoint with the victim's collection ID:

POST /graphql HTTP/1.1
Host: hoppscotch.example.com
Authorization: Bearer <ATTACKER_JWT>
Content-Type: application/json

{"query": "query GetVictimCollection($id: ID!) { userCollection(userCollectionID: $id) { id title type data userID } }", "variables": {"id": "VICTIM_COLLECTION_ID"}}

4. Receive sensitive data: The server returns the full collection including the data field (serialized JSON with auth tokens, API keys, headers) and the victim's userID.
5. Traverse the collection tree: Use childrenREST, childrenGQL, and parent field resolvers in subsequent queries to walk the victim's entire collection hierarchy and extract additional secrets (GitHub Advisory).

• Network: Unusual POST requests to /graphql containing userCollection queries with collection IDs not belonging to the authenticated user; high volume of userCollection queries from a single user account suggesting enumeration.
• Logs: GraphQL access logs showing userCollection queries returning data for collections owned by different userID values than the requesting JWT subject; repeated queries with incrementally varied collection IDs.
• Application Behavior: A single authenticated user account querying collections belonging to many different userID values in a short time window; queries including childrenREST, childrenGQL, and parent traversal fields in combination with userCollection (GitHub Advisory).

Upgrade Hoppscotch self-hosted (hoppscotch-backend Docker image) to version 2026.2.0 or later, which resolves the IDOR by adding ownership verification in the userCollection resolver and related field resolvers (GitHub Release). For instances that cannot be patched immediately, implement network-level access controls to restrict GraphQL API access to trusted users or IP ranges, and audit collection access logs for cross-user query patterns. After patching, review all collections for exposed credentials and rotate any potentially compromised API keys, bearer tokens, or secrets stored in collection data fields (GitHub Advisory).

The vulnerability was discovered and reported by bugbunny.ai and published by the Hoppscotch maintainer jamesgeorge007 on February 26, 2026. The fix was included in the same-day 2026.2.0 release via pull requests #5897 and #5902, with the release notes explicitly noting "resolve security advisories for IDOR and onboarding bypass" (GitHub Release). No significant broader media coverage or notable community debate has been identified beyond the official advisory.