Hoppscotch IDOR Vulnerability: Cross-user Private Data Exposure via GraphQL Resolvers

Vulnerability Overview Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers Vulnerability Type: IDOR (Insecure Direct Object Reference) Impact: Authenticated workspace members can retrieve, modify, or delete other users' private UserHistory IDs via team GraphQL resolvers. Description: Hoppscotch supports collaboration through shared workspaces, and its data model explicitly distinguishes between shared workspace resources and private user resources. However, the GraphQL API returns private UserHistory objects belonging to other users, leading to information leakage and unauthorized access. Scope of Impact Affected Versions: Hoppscotch-backend (Self-Hosted) (Docker Image) <= 2026.5.0 Fixed Version: 2026.6.0 Severity: High (CVSS v3 base metrics: 7.6 / 10) Attack Vector: Network Attack Complexity: Low Required Privileges: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: Low Availability: Low Remediation Reduce Exposure: Team GraphQL resolvers should return only the minimal set of collaboration-safe profile data, avoiding the exposure of other users' private UserHistory and session data. Ownership Verification: APIs that modify private history, such as and , must verify that the requester is the owner of the object, rather than relying solely on the object ID. Data Access Paths: All data access paths involving private history must include ownership enforcement, ensuring that only the true owner can read, modify, or delete the history. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Hoppscotch IDOR Vulnerability: Cross-user Private Data Exposure via GraphQL Resolvers

More from this source