EUVD-2026-60952Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
PR:L confirmed by workspace membership requirement; C:H for credential and session data exposure; I:L and A:L reflect limited history tampering and deletion without broader system impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0.
AnalysisAI
Multiple broken object-level authorization flaws in Hoppscotch's GraphQL backend allow any authenticated workspace member to read co-members' private API request history, active session data, authorization headers, stored credentials in environment variables, and application settings - and to mutate or delete victims' history entries without ownership validation. All self-hosted and applicable SaaS deployments running versions prior to 2026.6.0 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated account in the target Hoppscotch instance with membership in the same workspace as the victim - this corresponds to CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, score 7.6) is well-calibrated to the vulnerability: network-reachable GraphQL endpoint, no special attack preconditions beyond workspace membership, no victim interaction required, no scope change, with high confidentiality impact due to exposure of API keys, bearer tokens, and stored credentials in environment variables. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Hoppscotch backend to version 2026.6.0 or later, as documented in the release at https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0 and the security advisory GHSA-p25p-g9jp-7q46 at https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-p25p-g9jp-7q46; the upstream fix is in commit 9cc980bc4feb1f8e139b23b9de0beed0db72d4b7 via PR #6409. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Hoppscotch deployments running versions prior to 2026.6.0, audit recent workspace member activity logs for unauthorized data access, and prepare an incident response plan assuming potential credential exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today