CVE-2026-69189

HIGH 7.6

Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers

CVSS Score

7.6

EPSS Score

0.0%

EPSS Percentile

0th

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0.

CWE	CWE-200 CWE-639 CWE-862
Vendor	hoppscotch
Product	hoppscotch
Published	Aug 18, 2026
Last Updated	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for hoppscotch hoppscotch

Be the first to know when new high vulnerabilities affecting hoppscotch hoppscotch are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Affected Versions

hoppscotch / hoppscotch

< 2026.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-p25p-g9jp-7q46 github.com: https://github.com/hoppscotch/hoppscotch/pull/6409 github.com: https://github.com/hoppscotch/hoppscotch/commit/9cc980bc4feb1f8e139b23b9de0beed0db72d4b7 github.com: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0