CVE-2026-28216 - Vulnerability Analysis

Overview

Hoppscotch prior to 2026.2.0 contains a broken access control caused by missing ownership checks in user environment update and delete mutations, letting authenticated users read, modify, or delete other users' personal environments by ID, exploit requires user to be logged in.

Severity & Score

Impact

Authenticated attackers can read, modify, or delete other users' API keys and secrets, risking data compromise and service disruption.

Mitigation

Update to version 2026.2.0 or later.

References

• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-72rv-vc3j-5vqr
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 27, 2026

🟠 CVE-2026-28216 - High (8.3) hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's personal environment by ID. `user-environments.resolver.ts:82-109`, `updateUserEnvironment` mutation us... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28216/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner