Public Accessibility Vulnerability in Hoppscotch API Development Ecosystem
CVE-2026-59720

7.5HIGH

Key Information:

Vendor

Hoppscotch

Status
Hoppscotch
Vendor
CVE Published:
9 July 2026

What is CVE-2026-59720?

Prior to version 2026.6.0, the Hoppscotch API development ecosystem suffered from a flaw in the mock server creation process. Specifically, the system failed to properly persist the 'isPublic' field during mock server setup, defaulting it to 'true'. This misconfiguration could lead to private collections being inadvertently exposed as publicly accessible, allowing unauthorized access to sensitive API data without the need for authentication. The issue has been addressed in the latest version, 2026.6.0, mitigating the risks associated with this vulnerability.

Affected Version(s)

hoppscotch < 2026.6.0

References

https://github.com/hoppscotch/hoppscotch/security/advisor...
x_refsource_CONFIRM
https://github.com/hoppscotch/hoppscotch/pull/6410
x_refsource_MISC
https://github.com/hoppscotch/hoppscotch/commit/e4332110d...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.