hoppscotch 2023.4.5/2023.12.6 Endpoint /v1/onboarding/config access control

Summaryinfo

A vulnerability described as critical has been identified in hoppscotch. This issue affects some unknown processing of the file /v1/onboarding/config of the component Endpoint. The manipulation results in access control. This vulnerability is identified as CVE-2026-28215. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in hoppscotch. Affected is an unknown code block of the file /v1/onboarding/config of the component Endpoint. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP settings by sending a single HTTP POST request with no authentication. The endpoint POST /v1/onboarding/config has no authentication guard and performs no check on whether onboarding was already completed. A successful exploit allows the attacker to replace the instance's Google/GitHub/Microsoft OAuth application credentials with their own, causing all subsequent user logins via SSO to authenticate against the attacker's OAuth app. The attacker captures OAuth tokens and email addresses of every user who logs in after the exploit. Additionally, the endpoint returns a recovery token that can be used to read all stored secrets in plaintext, including SMTP passwords and any other configured credentials. Version 2026.2.0 fixes the issue.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-28215 since 02/25/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading to version 2026.2.0 eliminates this vulnerability. The upgrade is hosted for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• hoppscotch

Version

• 2023.4.5
• 2023.12.6

Website

• Product: https://github.com/hoppscotch/hoppscotch/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion