What is the CVSS score of EUVD-2026-42654?

EUVD-2026-42654 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Hoppscotch are affected by EUVD-2026-42654?

Hoppscotch mock servers configured as private are being created as public due to a logic flaw in the configuration validation, exposing sensitive API schemas and example payloads to unauthenticated…. A patch is available.

How to fix or mitigate EUVD-2026-42654?

24 hours: Audit all Hoppscotch instances to identify mock servers linked to private collections and determine whether sensitive data has been exposed. 7 days: Implement network-level access controls to restrict Hoppscotch mock server endpoints to authorized internal IP ranges and require API key or authentication token validation for all mock server access. 30 days: Monitor Hoppscotch vendor advisories and prepare upgrade procedures for when patched version becomes available.

Hoppscotch EUVD-2026-42654

| CVE-2026-59720 HIGH

Information Exposure (CWE-200)

2026-07-09 security-advisories@github.com

Information Disclosure

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote reads of private mock data give AV:N/AC:L/PR:N/UI:N and C:H, with no integrity or availability impact (I:N/A:N) and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 09, 2026 - 19:01 EUVD

Analysis Generated

Jul 09, 2026 - 18:36 vuln.today

DescriptionCVE.org

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without authentication and potentially expose sensitive API data. This issue is fixed in version 2026.6.0.

AnalysisAI

Unauthorized information disclosure in Hoppscotch prior to 2026.6.0 exposes mock servers linked to private collections to the public internet without authentication. The mock server creation logic in mock-server.service.ts silently drops the caller-supplied isPublic flag, while the Prisma schema defaults isPublic to true, so servers intended to be private are created as public. An unauthenticated remote attacker who reaches the mock endpoint can retrieve sensitive API data (schemas, example payloads, headers) the owner assumed was private; no public exploit was identified at time of analysis and the flaw is not in CISA KEV.

Technical ContextAI

Hoppscotch is an open-source API development ecosystem (a self-hostable Postman-style client and collaboration platform) whose backend persists state with Prisma over a relational database. The defect is a mismatch between the application service layer and the data model: schema.prisma declares isPublic with a default of true, and mock-server.service.ts fails to write the user-provided isPublic value on creation, so the database default takes effect. This is a classic CWE-200 Exposure of Sensitive Information to an Unauthorized Actor, rooted in an insecure default combined with a dropped input field, causing the access-control state (public vs. private) to diverge from the operator's intent.

RemediationAI

Vendor-released patch: 2026.6.0 - upgrade Hoppscotch to version 2026.6.0 or later (https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0), which persists the isPublic field correctly; the fix landed in PR #6410 (https://github.com/hoppscotch/hoppscotch/pull/6410) and commit e4332110d455a3012d5c77a9186bc4aa096e34f2. Until upgrading, audit existing mock servers and delete or recreate any that back private collections, since already-created servers were persisted as public; where feasible, restrict network access to mock server endpoints (for example via a reverse proxy or firewall allowlist so only trusted clients can reach them), accepting that this also blocks legitimate external consumers of intentionally public mocks. Full details are in advisory GHSA-c68f-wr5p-j6jf (https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-c68f-wr5p-j6jf).