CVE-2026-59720

EUVD-2026-42654
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without authentication and potentially expose sensitive API data. This issue is fixed in version 2026.6.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
hoppscotchhoppscotch
𝑥
< 2026.6.0
CNA
Common Weakness Enumeration
References
https://github.com/hoppscotch/hoppscotch/commit/e4332110d455a3012d5c77a9186bc4aa096e34f2
https://github.com/hoppscotch/hoppscotch/pull/6410
https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-c68f-wr5p-j6jf
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-c68f-wr5p-j6jf