CVE-2026-69189: Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hoppscotchto a version that resolves this vulnerability.Fixed in 2026.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Authenticated members of the same workspace are exposed. A malicious workspace member can access private data belonging to other members through the affected team GraphQL resolver paths.
What access and conditions are required for exploitation?
The attacker needs an authenticated workspace-member account and identifiers for another user's history entries to perform the history modifications or deletions. No user interaction is required.
What data and actions are at risk?
Affected paths can disclose private request history, REST and GraphQL session data, request contents, authorization headers, environment values, and settings. The history operations can also modify star status or delete another user's private history entries.
What is the remediation?
Upgrade Hoppscotch to version 2026.6.0, which fixes the issue. The provided information does not describe an alternative mitigation for deployments that cannot be upgraded immediately.