CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-28217

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized `data` field containing HTTP requests with headers and potentially secrets — to any authenticated user, without verifying that the requesting user owns the collection. This is an Insecure Direct Object Reference (IDOR) caused by a missing authorization check that exists on every other operation in the same resolver. Version 2026.2.0 fixes the issue.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 8.8%

CVSS Severity

CVSS v3 Score 6.5

References

Products affected by CVE-2026-28217

Hoppscotch » Hoppscotch » Version: 0.1.0

cpe:2.3:a:hoppscotch:hoppscotch:0.1.0
Hoppscotch » Hoppscotch » Version: 1.0.0

cpe:2.3:a:hoppscotch:hoppscotch:1.0.0
Hoppscotch » Hoppscotch » Version: 1.10.0

cpe:2.3:a:hoppscotch:hoppscotch:1.10.0
Hoppscotch » Hoppscotch » Version: 1.12.0

cpe:2.3:a:hoppscotch:hoppscotch:1.12.0
Hoppscotch » Hoppscotch » Version: 1.5.0

cpe:2.3:a:hoppscotch:hoppscotch:1.5.0
Hoppscotch » Hoppscotch » Version: 1.8.0

cpe:2.3:a:hoppscotch:hoppscotch:1.8.0
Hoppscotch » Hoppscotch » Version: 1.9.0

cpe:2.3:a:hoppscotch:hoppscotch:1.9.0
Hoppscotch » Hoppscotch » Version: 1.9.5

cpe:2.3:a:hoppscotch:hoppscotch:1.9.5
Hoppscotch » Hoppscotch » Version: 1.9.7

cpe:2.3:a:hoppscotch:hoppscotch:1.9.7
Hoppscotch » Hoppscotch » Version: 1.9.9

cpe:2.3:a:hoppscotch:hoppscotch:1.9.9
Hoppscotch » Hoppscotch » Version: 2.0.0

cpe:2.3:a:hoppscotch:hoppscotch:2.0.0
Hoppscotch » Hoppscotch » Version: 2.1.0

cpe:2.3:a:hoppscotch:hoppscotch:2.1.0
Hoppscotch » Hoppscotch » Version: 2.2.0

cpe:2.3:a:hoppscotch:hoppscotch:2.2.0
Hoppscotch » Hoppscotch » Version: 2.2.1

cpe:2.3:a:hoppscotch:hoppscotch:2.2.1
Hoppscotch » Hoppscotch » Version: 2023.12.0

cpe:2.3:a:hoppscotch:hoppscotch:2023.12.0
Hoppscotch » Hoppscotch » Version: 2023.12.1

cpe:2.3:a:hoppscotch:hoppscotch:2023.12.1
Hoppscotch » Hoppscotch » Version: 2023.12.2

cpe:2.3:a:hoppscotch:hoppscotch:2023.12.2
Hoppscotch » Hoppscotch » Version: 2023.12.3

cpe:2.3:a:hoppscotch:hoppscotch:2023.12.3
Hoppscotch » Hoppscotch » Version: 2023.12.4

cpe:2.3:a:hoppscotch:hoppscotch:2023.12.4
Hoppscotch » Hoppscotch » Version: 2023.12.5

cpe:2.3:a:hoppscotch:hoppscotch:2023.12.5
Hoppscotch » Hoppscotch » Version: 2023.12.6

cpe:2.3:a:hoppscotch:hoppscotch:2023.12.6
Hoppscotch » Hoppscotch » Version: 2023.4.0

cpe:2.3:a:hoppscotch:hoppscotch:2023.4.0
Hoppscotch » Hoppscotch » Version: 2023.4.1

cpe:2.3:a:hoppscotch:hoppscotch:2023.4.1
Hoppscotch » Hoppscotch » Version: 2023.4.2

cpe:2.3:a:hoppscotch:hoppscotch:2023.4.2
Hoppscotch » Hoppscotch » Version: 2023.4.3

cpe:2.3:a:hoppscotch:hoppscotch:2023.4.3
Hoppscotch » Hoppscotch » Version: 2023.4.4

cpe:2.3:a:hoppscotch:hoppscotch:2023.4.4
Hoppscotch » Hoppscotch » Version: 2023.4.5

cpe:2.3:a:hoppscotch:hoppscotch:2023.4.5
Hoppscotch » Hoppscotch » Version: 2023.4.6

cpe:2.3:a:hoppscotch:hoppscotch:2023.4.6
Hoppscotch » Hoppscotch » Version: 2023.4.7

cpe:2.3:a:hoppscotch:hoppscotch:2023.4.7
Hoppscotch » Hoppscotch » Version: 2023.4.8

cpe:2.3:a:hoppscotch:hoppscotch:2023.4.8
Hoppscotch » Hoppscotch » Version: 2023.8.0

cpe:2.3:a:hoppscotch:hoppscotch:2023.8.0
Hoppscotch » Hoppscotch » Version: 2023.8.1

cpe:2.3:a:hoppscotch:hoppscotch:2023.8.1
Hoppscotch » Hoppscotch » Version: 2023.8.2

cpe:2.3:a:hoppscotch:hoppscotch:2023.8.2
Hoppscotch » Hoppscotch » Version: 2023.8.3

cpe:2.3:a:hoppscotch:hoppscotch:2023.8.3
Hoppscotch » Hoppscotch » Version: 2023.8.4

cpe:2.3:a:hoppscotch:hoppscotch:2023.8.4
Hoppscotch » Hoppscotch » Version: 2024.10.0

cpe:2.3:a:hoppscotch:hoppscotch:2024.10.0
Hoppscotch » Hoppscotch » Version: 2024.10.1

cpe:2.3:a:hoppscotch:hoppscotch:2024.10.1
Hoppscotch » Hoppscotch » Version: 2024.10.2

cpe:2.3:a:hoppscotch:hoppscotch:2024.10.2
Hoppscotch » Hoppscotch » Version: 2024.11.0

cpe:2.3:a:hoppscotch:hoppscotch:2024.11.0
Hoppscotch » Hoppscotch » Version: 2024.12.0

cpe:2.3:a:hoppscotch:hoppscotch:2024.12.0
Hoppscotch » Hoppscotch » Version: 2024.12.1

cpe:2.3:a:hoppscotch:hoppscotch:2024.12.1
Hoppscotch » Hoppscotch » Version: 2024.12.2

cpe:2.3:a:hoppscotch:hoppscotch:2024.12.2
Hoppscotch » Hoppscotch » Version: 2024.3.0

cpe:2.3:a:hoppscotch:hoppscotch:2024.3.0
Hoppscotch » Hoppscotch » Version: 2024.3.1

cpe:2.3:a:hoppscotch:hoppscotch:2024.3.1
Hoppscotch » Hoppscotch » Version: 2024.3.2

cpe:2.3:a:hoppscotch:hoppscotch:2024.3.2
Hoppscotch » Hoppscotch » Version: 2024.3.3

cpe:2.3:a:hoppscotch:hoppscotch:2024.3.3
Hoppscotch » Hoppscotch » Version: 2024.3.4

cpe:2.3:a:hoppscotch:hoppscotch:2024.3.4
Hoppscotch » Hoppscotch » Version: 2024.6.0

cpe:2.3:a:hoppscotch:hoppscotch:2024.6.0
Hoppscotch » Hoppscotch » Version: 2024.6.1

cpe:2.3:a:hoppscotch:hoppscotch:2024.6.1
Hoppscotch » Hoppscotch » Version: 2024.7.0

cpe:2.3:a:hoppscotch:hoppscotch:2024.7.0
Hoppscotch » Hoppscotch » Version: 2024.7.1

cpe:2.3:a:hoppscotch:hoppscotch:2024.7.1
Hoppscotch » Hoppscotch » Version: 2024.7.2

cpe:2.3:a:hoppscotch:hoppscotch:2024.7.2
Hoppscotch » Hoppscotch » Version: 2024.8.0

cpe:2.3:a:hoppscotch:hoppscotch:2024.8.0
Hoppscotch » Hoppscotch » Version: 2024.8.1

cpe:2.3:a:hoppscotch:hoppscotch:2024.8.1
Hoppscotch » Hoppscotch » Version: 2024.8.2

cpe:2.3:a:hoppscotch:hoppscotch:2024.8.2
Hoppscotch » Hoppscotch » Version: 2024.8.3

cpe:2.3:a:hoppscotch:hoppscotch:2024.8.3
Hoppscotch » Hoppscotch » Version: 2024.9.0

cpe:2.3:a:hoppscotch:hoppscotch:2024.9.0
Hoppscotch » Hoppscotch » Version: 2024.9.1

cpe:2.3:a:hoppscotch:hoppscotch:2024.9.1
Hoppscotch » Hoppscotch » Version: 2024.9.2

cpe:2.3:a:hoppscotch:hoppscotch:2024.9.2
Hoppscotch » Hoppscotch » Version: 2024.9.3

cpe:2.3:a:hoppscotch:hoppscotch:2024.9.3
Hoppscotch » Hoppscotch » Version: 2025.1.0

cpe:2.3:a:hoppscotch:hoppscotch:2025.1.0
Hoppscotch » Hoppscotch » Version: 2025.1.1

cpe:2.3:a:hoppscotch:hoppscotch:2025.1.1
Hoppscotch » Hoppscotch » Version: 2025.10.0

cpe:2.3:a:hoppscotch:hoppscotch:2025.10.0
Hoppscotch » Hoppscotch » Version: 2025.10.1

cpe:2.3:a:hoppscotch:hoppscotch:2025.10.1
Hoppscotch » Hoppscotch » Version: 2025.11.0

cpe:2.3:a:hoppscotch:hoppscotch:2025.11.0
Hoppscotch » Hoppscotch » Version: 2025.11.1

cpe:2.3:a:hoppscotch:hoppscotch:2025.11.1
Hoppscotch » Hoppscotch » Version: 2025.11.2

cpe:2.3:a:hoppscotch:hoppscotch:2025.11.2
Hoppscotch » Hoppscotch » Version: 2025.12.0

cpe:2.3:a:hoppscotch:hoppscotch:2025.12.0
Hoppscotch » Hoppscotch » Version: 2025.12.1

cpe:2.3:a:hoppscotch:hoppscotch:2025.12.1
Hoppscotch » Hoppscotch » Version: 2025.2.0

cpe:2.3:a:hoppscotch:hoppscotch:2025.2.0
Hoppscotch » Hoppscotch » Version: 2025.2.1

cpe:2.3:a:hoppscotch:hoppscotch:2025.2.1
Hoppscotch » Hoppscotch » Version: 2025.2.2

cpe:2.3:a:hoppscotch:hoppscotch:2025.2.2
Hoppscotch » Hoppscotch » Version: 2025.2.3

cpe:2.3:a:hoppscotch:hoppscotch:2025.2.3
Hoppscotch » Hoppscotch » Version: 2025.3.0

cpe:2.3:a:hoppscotch:hoppscotch:2025.3.0
Hoppscotch » Hoppscotch » Version: 2025.3.1

cpe:2.3:a:hoppscotch:hoppscotch:2025.3.1
Hoppscotch » Hoppscotch » Version: 2025.3.2

cpe:2.3:a:hoppscotch:hoppscotch:2025.3.2
Hoppscotch » Hoppscotch » Version: 2025.4.0

cpe:2.3:a:hoppscotch:hoppscotch:2025.4.0
Hoppscotch » Hoppscotch » Version: 2025.4.1

cpe:2.3:a:hoppscotch:hoppscotch:2025.4.1
Hoppscotch » Hoppscotch » Version: 2025.4.2

cpe:2.3:a:hoppscotch:hoppscotch:2025.4.2
Hoppscotch » Hoppscotch » Version: 2025.5.0

cpe:2.3:a:hoppscotch:hoppscotch:2025.5.0
Hoppscotch » Hoppscotch » Version: 2025.5.1

cpe:2.3:a:hoppscotch:hoppscotch:2025.5.1
Hoppscotch » Hoppscotch » Version: 2025.5.2

cpe:2.3:a:hoppscotch:hoppscotch:2025.5.2
Hoppscotch » Hoppscotch » Version: 2025.5.3

cpe:2.3:a:hoppscotch:hoppscotch:2025.5.3
Hoppscotch » Hoppscotch » Version: 2025.5.4

cpe:2.3:a:hoppscotch:hoppscotch:2025.5.4
Hoppscotch » Hoppscotch » Version: 2025.6.0

cpe:2.3:a:hoppscotch:hoppscotch:2025.6.0
Hoppscotch » Hoppscotch » Version: 2025.6.1

cpe:2.3:a:hoppscotch:hoppscotch:2025.6.1
Hoppscotch » Hoppscotch » Version: 2025.7.0

cpe:2.3:a:hoppscotch:hoppscotch:2025.7.0
Hoppscotch » Hoppscotch » Version: 2025.7.1

cpe:2.3:a:hoppscotch:hoppscotch:2025.7.1
Hoppscotch » Hoppscotch » Version: 2025.8.0

cpe:2.3:a:hoppscotch:hoppscotch:2025.8.0
Hoppscotch » Hoppscotch » Version: 2025.8.1

cpe:2.3:a:hoppscotch:hoppscotch:2025.8.1
Hoppscotch » Hoppscotch » Version: 2025.9.0

cpe:2.3:a:hoppscotch:hoppscotch:2025.9.0
Hoppscotch » Hoppscotch » Version: 2025.9.1

cpe:2.3:a:hoppscotch:hoppscotch:2025.9.1
Hoppscotch » Hoppscotch » Version: 2025.9.2

cpe:2.3:a:hoppscotch:hoppscotch:2025.9.2
Hoppscotch » Hoppscotch » Version: 2026.1.0

cpe:2.3:a:hoppscotch:hoppscotch:2026.1.0
Hoppscotch » Hoppscotch » Version: 2026.1.1

cpe:2.3:a:hoppscotch:hoppscotch:2026.1.1
Hoppscotch » Hoppscotch » Version: 3.0.0

cpe:2.3:a:hoppscotch:hoppscotch:3.0.0
Hoppscotch » Hoppscotch » Version: 3.0.1

cpe:2.3:a:hoppscotch:hoppscotch:3.0.1

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-28217

Products

Pricing

Contact Us