Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments…
High CVSS 7.6
Summary
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read pri…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/hoppscotch/hoppscotch/commit/9cc980bc4feb1f8e139b23b9de0beed0db72d4b7
- https://github.com/hoppscotch/hoppscotch/pull/6409
- https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0
- https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-p25p-g9jp-7q46
- https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-p25p-g9jp-7q46
Timeline
- nvd_ingest NVD