CVE-2026-28217 - Vulnerability Analysis

Overview

Hoppscotch prior to 2026.2.0 contains an insecure direct object reference caused by missing authorization check in the userCollection GraphQL query, letting authenticated users access other users' collection data, exploit requires authentication.

Severity & Score

Impact

Authenticated attackers can access other users' full collection data, including sensitive HTTP request headers and secrets.

Mitigation

Update to version 2026.2.0 or later.

References

• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-m5pg-r4jp-qq75

Social Media Activity(1 post)

CyberNetsecIO

@netsecio

Mar 23, 2026

📰 CISA KEV Catalog Updated: Federal Agencies Must Patch Exploited Flaws in Apple, Laravel, Craft CMS 📢 CISA KEV UPDATE: Actively exploited flaws in Apple visionOS (CVE-2026-28217), Laravel (CVE-2024-4671), & Craft CMS (CVE-2026-25487) added to catalog. Federal agencies must patch by April 12. All orgs urged to patch NOW! ⚠️ #KEV #CISA 🔗 https://cyber.netsecops.io/articles/cisa-adds-apple-laravel-craft-cms-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner