CVE-2026-69189
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Hoppscotch, an open source API development ecosystem, prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries.
Risk Assessment
An authenticated team member can access sensitive data of other members, including authorization headers and request contents, and manipulate their history.
Recommendation
Update Hoppscotch to version 2026.6.0.
Other vulnerabilities in Hoppscotch
See all- CVE-2026-44478High
CVE-2026-44478 vulnerability in hoppscotch allows unauthenticated users to access infrastructure secrets in plaintext via the GET /v1/onboarding/config endpoint when the ONBOARDING_RECOVERY_TOKEN is an empty string. This issue is fixed in version 2026.4.0.
- CVE-2026-50160Critical
In self-hosted Hoppscotch deployments version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The missing whitelist: true in NestJS ValidationPipe allows extra request properties like JWT_SECRET and SESSION_SECRET to be treated as valid InfraConfig entries, enabling an attacker to overwrite them.
- CVE-2026-34932Critical
Hoppscotch prior to version 2026.3.0 has a stored XSS vulnerability that can lead to CSRF.
- CVE-2026-34931Critical
Hoppscotch prior to version 2026.3.0 has an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account.
- CVE-2026-59721High
A vulnerability in Hoppscotch before version 2026.6.0 allows an admin to execute arbitrary commands as root in the backend container. The attack involves manipulating the MAILER_SMTP_URL parameter in the updateInfraConfigs GraphQL mutation, which is then parsed by nodemailer into sendmail transport options.
- CVE-2026-59720High
In Hoppscotch prior to version 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field, while schema.prisma defaults isPublic to true. This causes mock servers linked to private collections to be publicly accessible without authentication, potentially exposing sensitive API data.
- CVE-2026-34848Medium
Hoppscotch, an open source API development ecosystem, contains a stored XSS vulnerability in the team member overflow tooltip via display name. This issue exists prior to version 2026.3.0.
- CVE-2026-34847Medium
In hoppscotch before version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation.
- CVE-2023-34097High
In versions prior to 2023.4.5, hoppscotch exposes the database password in logs when showing the database connection string. Attackers with access to system logs can gain full access to the database.
Original NVD description (English source)
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS