High severity · published Jul 9, 2026
CVE-2026-59720
Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without authentication and potentially expose sensitive API data. This issue is fixed in version 2026.6.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
hoppscotch · hoppscotch
< 2026.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59720
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59720
github.com
https://github.com/hoppscotch/hoppscotch/commit/e4332110d455a3012d5c77a9186bc4aa096e34f2
github.com
https://github.com/hoppscotch/hoppscotch/pull/6410
github.com
https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0
github.com
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-c68f-wr5p-j6jf
More from hoppscotch
10.0
CVE-2026-50160
Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
9.6
CVE-2026-34931
hoppscotch: Improper loopback redirect_uri validation in device-login flow
9.3
CVE-2026-34932
hoppscotch: Stored XSS via mock server responses on backend origin
9.1
CVE-2026-28215
hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover
8.8
CVE-2023-34097
Database password exposed in logs in hoppscotch