CVE-2026-59720: Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without authentication and potentially expose sensitive API data. This issue is fixed in version 2026.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hoppscotchto a version that resolves this vulnerability.Fixed in 2026.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59720?
CVE-2026-59720 has a severity rating of 7.5, classified as high.
How do I fix CVE-2026-59720?
To fix CVE-2026-59720, update to Hoppscotch version 2026.6.0 or later to ensure proper handling of the isPublic field.
What does CVE-2026-59720 expose?
CVE-2026-59720 exposes private collection data from mock servers to the public due to insecure default configurations.
What is the impact of CVE-2026-59720?
The impact of CVE-2026-59720 is that private data can be accessed publicly without authentication.
Which component is affected by CVE-2026-59720?
CVE-2026-59720 affects the mock server creation process in the mock-server.service.ts file of Hoppscotch.