A missing authorization check in Hoppscotch versions prior to 2026.2.0 allows any authenticated user to compromise the sensitive API keys and secrets of other users.

This is an authorization bypass (CWE-639) occurring in the user-environments.resolver.ts file. The updateUserEnvironment and deleteUserEnvironment mutations fail to validate ownership of the requested environment ID, allowing any authenticated user to perform unauthorized actions on another user's data.

The vulnerability poses a high risk to business operations, as it permits attackers to exfiltrate or manipulate API keys, authentication tokens, and sensitive secrets stored within user environments. With a CVSS score of 8.3, the impact is significant, potentially leading to unauthorized access to downstream systems integrated with the compromised API credentials. The ability to delete environments also introduces a risk of service disruption for affected users.

Immediate Action: Update the Hoppscotch installation to version 2026.2.0 or later immediately to incorporate the necessary ownership filters.

Proactive Monitoring: Review application logs for suspicious patterns, specifically focusing on unauthorized GraphQL mutation attempts involving environment IDs that do not belong to the requesting user.

Compensating Controls: Implement strict network access controls and ensure that the Hoppscotch instance is not exposed to untrusted networks, reducing the likelihood of an attacker obtaining valid authentication to exploit the flaw.

Public Exploit Available: No.

The vulnerability represents a critical failure in authorization logic that directly exposes sensitive secrets. Organizations utilizing Hoppscotch should prioritize upgrading to version 2026.2.0 as the primary and most effective method to secure environment data against unauthorized access.