CVE-2026-28216

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28216", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T15:28:40.649Z", "datePublished": "2026-02-26T22:36:50.539Z", "dateUpdated": "2026-02-27T18:43:16.218Z"}, "containers": {"cna": {"title": "hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-72rv-vc3j-5vqr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-72rv-vc3j-5vqr"}, {"name": "https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0"}], "affected": [{"vendor": "hoppscotch", "product": "hoppscotch", "versions": [{"version": "< 2026.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:36:50.539Z"}, "descriptions": [{"lang": "en", "value": "hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's personal environment by ID. `user-environments.resolver.ts:82-109`, `updateUserEnvironment` mutation uses `@UseGuards(GqlAuthGuard)` but is missing the `@GqlUser()` decorator entirely. The user's identity is never extracted, so the service receives only the environment ID and performs a `prisma.userEnvironment.update({ where: { id } })` without any ownership filter. `deleteUserEnvironment` does extract the user but the service only uses the UID to check if the target is a global environment. Actual delete query uses WHERE { id } without AND userUid. hoppscotch environments store API keys, auth tokens and secrets used in API requests. An authenticated attacker who obtains another user's environment ID can read their secrets, replace them with malicious values or delete them entirely. The environment ID format is CUID, which limits mass exploitation but insider threat and combined info leak scenarios are realistic. Version 2026.2.0 fixes the issue."}], "source": {"advisory": "GHSA-72rv-vc3j-5vqr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T18:43:04.669293Z", "id": "CVE-2026-28216", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T18:43:16.218Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28216", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-27T18:43:04.669293Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T18:43:11.472Z"}}], "cna": {"title": "hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment", "source": {"advisory": "GHSA-72rv-vc3j-5vqr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "hoppscotch", "product": "hoppscotch", "versions": [{"status": "affected", "version": "< 2026.2.0"}]}], "references": [{"url": "https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-72rv-vc3j-5vqr", "name": "https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-72rv-vc3j-5vqr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0", "name": "https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's personal environment by ID. `user-environments.resolver.ts:82-109`, `updateUserEnvironment` mutation uses `@UseGuards(GqlAuthGuard)` but is missing the `@GqlUser()` decorator entirely. The user's identity is never extracted, so the service receives only the environment ID and performs a `prisma.userEnvironment.update({ where: { id } })` without any ownership filter. `deleteUserEnvironment` does extract the user but the service only uses the UID to check if the target is a global environment. Actual delete query uses WHERE { id } without AND userUid. hoppscotch environments store API keys, auth tokens and secrets used in API requests. An authenticated attacker who obtains another user's environment ID can read their secrets, replace them with malicious values or delete them entirely. The environment ID format is CUID, which limits mass exploitation but insider threat and combined info leak scenarios are realistic. Version 2026.2.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:36:50.539Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28216", "state": "PUBLISHED", "dateUpdated": "2026-02-27T18:43:16.218Z", "dateReserved": "2026-02-25T15:28:40.649Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T22:36:50.539Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hoppscotch", "vendor": "hoppscotch", "versions": [{"status": "affected", "version": "< 2026.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hoppscotch:hoppscotch:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FF8DA47-4B0B-4592-80AD-66C7913AD164", "versionEndExcluding": "2026.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's personal environment by ID. `user-environments.resolver.ts:82-109`, `updateUserEnvironment` mutation uses `@UseGuards(GqlAuthGuard)` but is missing the `@GqlUser()` decorator entirely. The user's identity is never extracted, so the service receives only the environment ID and performs a `prisma.userEnvironment.update({ where: { id } })` without any ownership filter. `deleteUserEnvironment` does extract the user but the service only uses the UID to check if the target is a global environment. Actual delete query uses WHERE { id } without AND userUid. hoppscotch environments store API keys, auth tokens and secrets used in API requests. An authenticated attacker who obtains another user's environment ID can read their secrets, replace them with malicious values or delete them entirely. The environment ID format is CUID, which limits mass exploitation but insider threat and combined info leak scenarios are realistic. Version 2026.2.0 fixes the issue."}, {"lang": "es", "value": "hoppscotch es un ecosistema de desarrollo de API de c\u00f3digo abierto. Antes de la versi\u00f3n 2026.2.0, cualquier usuario autenticado puede leer, modificar o eliminar el entorno personal de otro usuario por ID. `user-environments.resolver.ts:82-109`, la mutaci\u00f3n `updateUserEnvironment` utiliza `@UseGuards(GqlAuthGuard)` pero carece por completo del decorador `@GqlUser()`. La identidad del usuario nunca se extrae, por lo que el servicio recibe solo el ID del entorno y realiza una `prisma.userEnvironment.update({ where: { id } })` sin ning\u00fan filtro de propiedad. La mutaci\u00f3n `deleteUserEnvironment` s\u00ed extrae al usuario, pero el servicio solo utiliza el UID para verificar si el objetivo es un entorno global. La consulta de eliminaci\u00f3n real utiliza WHERE { id } sin AND userUid. Los entornos de hoppscotch almacenan claves API, tokens de autenticaci\u00f3n y secretos utilizados en solicitudes API. Un atacante autenticado que obtiene el ID del entorno de otro usuario puede leer sus secretos, reemplazarlos con valores maliciosos o eliminarlos por completo. El formato del ID del entorno es CUID, lo que limita la explotaci\u00f3n masiva, pero las amenazas internas y los escenarios combinados de fuga de informaci\u00f3n son realistas. La versi\u00f3n 2026.2.0 corrige el problema."}], "id": "CVE-2026-28216", "lastModified": "2026-06-17T10:28:20.963", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28216", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T18:43:04.669293Z", "version": "2.0.3"}}]}, "published": "2026-02-26T23:16:36.100", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-72rv-vc3j-5vqr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2026.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "hoppscotch", "source": "cna", "vendor": "hoppscotch"}, "product": "hoppscotch", "vendor": "hoppscotch"}], "analysis": {"en": {"generated_at": "2026-04-16T15:56:41.067095+00:00", "value": {"mitigation_remediation": ["Upgrade Hoppscotch to version 2026.2.0 or newer.", "Implement a temporary guard that verifies the environment owner before processing update or delete requests.", "Re\u2011generate and rotate all API keys and secrets stored in environments that could have been exposed prior to the upgrade."], "summary": {"action": "Patch ASAP", "impact": "Insecure Direct Object Reference enabling unauthorized access to personal environments and secrets"}, "threat_synthesis": {"affected_systems": "The affected vendor is Hoppscotch, the open\u2011source API development ecosystem. All releases older than 2026.2.0 are vulnerable; the issue is resolved starting with release 2026.2.0. Users who have installed any pre\u20112026.2.0 version are at risk.", "description_and_impact": "An Insecure Direct Object Reference exists in Hoppscotch's updateUserEnvironment and deleteUserEnvironment mutations. The code fails to enforce ownership checks, allowing any authenticated user to read, modify or delete another user's personal environment by providing its ID. The vulnerable code performs an update or delete query that filters only on the environment ID, not on the user identifier, thereby exposing API keys, authentication tokens and other secrets stored in user environments.", "risk_and_exploitability": "The CVSS base score is 8.3, indicating high severity. The EPSS score is below 1\u202f%, implying that exploitation is expected to be rare, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack requires only an authenticated account and an environment ID, an insider threat or a compromised account could leverage the IDOR to exfiltrate sensitive secrets. The absence of ownership filtering makes the risk perpetually available to any authenticated user who discovers or guesses the target ID."}}}}, "created": "2026-02-27T09:03:51.400336+00:00", "updated": "2026-04-16T16:00:13.884127+00:00", "vendors": ["hoppscotch", "hoppscotch$PRODUCT$hoppscotch"]}