Vulnerability · Published Jul 9, 2026 · Assigned by GitHub_M

CVE-2026-59720Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server

High 7.5

In plain English

A high-severity information exposure in hoppscotch from hoppscotch. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 51.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without authentication and potentially expose sensitive API data. This issue is fixed in version 2026.6.0.

Affected products (as reported)

Vendor	Product	Versions
hoppscotch	hoppscotch	< 2026.6.0

Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-c68f-wr5p-j6jf x_refsource_CONFIRM
https://github.com/hoppscotch/hoppscotch/pull/6410 x_refsource_MISC
https://github.com/hoppscotch/hoppscotch/commit/e4332110d455a3012d5c77a9186bc4aa096e34f2 x_refsource_MISC
https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0 x_refsource_MISC