CyberRota Analysis
AI-GeneratedThe Hoppscotch API development ecosystem prior to version 2026.6.0 is vulnerable to unauthorized access to private user data, including sensitive request history, session information, and environment settings, due to improper access controls in several GraphQL paths. This allows authenticated users to read and manipulate another workspace member's private data, posing a significant risk to user privacy and data integrity. Organizations using affected versions should prioritize upgrading to version 2026.6.0 to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0.