« Volver al listado

CVE-2026-28217

Estado: AnalizadaMedia (6.5)—

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized `data` field containing HTTP requests with headers and potentially secrets — to any authenticated user, without verifying that the requesting user owns the collection. This is an Insecure Direct Object Reference (IDOR) caused by a missing authorization check that exists on every other operation in the same resolver. Version 2026.2.0 fixes the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hoppscotch — Hoppscotch

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-28217",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28217",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-27T18:41:50.745815Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "hoppscotch",
          "product": "hoppscotch",
          "versions": [
            {
              "status": "affected",
              "version": "< 2026.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-26T23:16:36.263",
  "references": [
    {
      "url": "https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-m5pg-r4jp-qq75",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized `data` field containing HTTP requests with headers and potentially secrets — to any authenticated user, without verifying that the requesting user owns the collection. This is an Insecure Direct Object Reference (IDOR) caused by a missing authorization check that exists on every other operation in the same resolver. Version 2026.2.0 fixes the issue."
    },
    {
      "lang": "es",
      "value": "hoppscotch es un ecosistema de desarrollo de API de código abierto. Antes de la versión 2026.2.0, la consulta GraphQL 'userCollection' acepta un ID de colección arbitrario y devuelve los datos completos de la colección — incluyendo título, tipo y el campo 'data' serializado que contiene solicitudes HTTP con encabezados y potencialmente secretos — a cualquier usuario autenticado, sin verificar que el usuario solicitante sea el propietario de la colección. Esto es una Referencia Directa a Objeto Insegura (IDOR) causada por una verificación de autorización faltante que existe en cualquier otra operación en el mismo *resolver*. La versión 2026.2.0 corrige el problema."
    }
  ],
  "lastModified": "2026-06-17T10:28:21.083",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hoppscotch:hoppscotch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3FF8DA47-4B0B-4592-80AD-66C7913AD164",
              "versionEndExcluding": "2026.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}