A vulnerable GraphQL query in Hoppscotch allows any authenticated user to request any collection by ID and receive its full data, including confidential HTTP requests with headers that may contain secrets. This constitutes an insecure direct object reference, meaning an attacker can read other users’ private collections without authorization. The lack of an ownership check means the impact is broad, exposing sensitive request data to anyone with valid credentials, potentially compromising confidentiality of multiple users' API calls. This vulnerability is an instance of CWE‑639 and CWE‑862, reflecting an authorization bypass through user‑controlled input and a missing authorization check, respectively.

Hoppscotch, version prior to 2026.2.0, which is the open‑source API development ecosystem. The vulnerability exists in the GraphQL resolver that handles the userCollection query; any installation of the affected version of Hoppscotch is at risk.

The CVSS v3 score of 6.5 reflects moderate severity, but the EPSS score of less than 1% indicates that exploitation is unlikely at present. The vulnerability is not in the CISA KEV catalog. An attacker only needs to authenticate to the application; if they can inject a request with any collection ID, they will receive full data. No additional privileges are required beyond an authenticated session, making it relatively easy to exploit for any user with access.