CVE-2026-28216

CVE-2026-28216 affects Hoppscotch before 2026.2.0. The issue is an improper authorization check in the user environments flow: the updateUserEnvironment mutation uses GqlAuthGuard but lacks a @GqlUser() decorator, so the service can process only the environment ID (no ownership filter) and execut...