An Insecure Direct Object Reference exists in Hoppscotch's updateUserEnvironment and deleteUserEnvironment mutations. The code fails to enforce ownership checks, allowing any authenticated user to read, modify or delete another user's personal environment by providing its ID. The vulnerable code performs an update or delete query that filters only on the environment ID, not on the user identifier, thereby exposing API keys, authentication tokens and other secrets stored in user environments.

The affected vendor is Hoppscotch, the open‑source API development ecosystem. All releases older than 2026.2.0 are vulnerable; the issue is resolved starting with release 2026.2.0. Users who have installed any pre‑2026.2.0 version are at risk.

The CVSS base score is 8.3, indicating high severity. The EPSS score is below 1 %, implying that exploitation is expected to be rare, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack requires only an authenticated account and an environment ID, an insider threat or a compromised account could leverage the IDOR to exfiltrate sensitive secrets. The absence of ownership filtering makes the risk perpetually available to any authenticated user who discovers or guesses the target ID.