CVE-2026-59720 Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server
Attackers can access private API collection data via mock servers due to insecure default settings exposing data without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-59720?
CVE-2026-59720 is a high-severity vulnerability in hoppscotch, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without authentication and potentially expose sensitive API data. This issue is fixed in version 2026.6.0.
Which versions are affected by CVE-2026-59720?
How do I fix CVE-2026-59720?
No fix has been published for CVE-2026-59720 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-59720 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59720 exists.
Sources
Also known as GHSA-c68f-wr5p-j6jf.