Description

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-18T15:17:00.930Z",
  "pubdate": "2026-08-18T15:17:00.930Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Hoppscotch prior to version 2026.6.0, affecting multiple GraphQL paths and the UserHistory service.\nThe vulnerability allows an authenticated workspace member to access, modify, or delete private user data belonging to other workspace members.\nImpacted data and components include team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, settings, toggleHistoryStarStatus, and removeRequestFromHistory.\nThe flaw exposes sensitive information such as private request history, session data, request contents, authorization headers, environment values, and application settings.\nThe risk implications are severe, as authenticated attackers can harvest credentials, sensitive tokens, and proprietary API interaction histories across shared workspaces.\nExploitation requires authenticated access to the application as a workspace member and the ability to interact with the exposed GraphQL endpoints or invoke specific UserHistory service functions using arbitrary identifiers.\nRemediation requires upgrading Hoppscotch to version 2026.6.0 or later, where proper authorization checks and ownership validation have been implemented.",
  "technicalDetails": "The root cause of the vulnerability is a failure in the application's access control logic to enforce proper userUid ownership and resource isolation across specific GraphQL paths and service methods.\nThe vulnerable components include the GraphQL paths team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings, alongside the UserHistory service functions toggleHistoryStarStatus and removeRequestFromHistory.\nThe affected versions are all Hoppscotch deployments prior to version 2026.6.0.\nAuthentication and privilege requirements are minimal: the attacker must be an authenticated workspace member, but they do not require administrative privileges to target other members within the same or accessible workspaces.\nExploitation occurs when an authenticated user crafts GraphQL queries targeting the vulnerable paths or invokes the UserHistory service methods using another user's history identifier.\nBecause the backend fails to validate whether the requesting user owns the requested resource or history identifier, the application processes the request and returns sensitive data or executes unauthorized modifications.\nThe attack flow proceeds as follows: First, the attacker identifies or guesses another user's history identifier or constructs queries against the exposed GraphQL endpoints. Second, the attacker issues a request to access restricted paths such as RESTHistory, currentRESTSession, or environments, which incorrectly disclose private user data including authorization headers and environment values. Third, the attacker leverages the toggleHistoryStarStatus or removeRequestFromHistory functions with arbitrary history identifiers to modify the star status or delete the victim's private history entries without ownership verification.\nThe post-exploitation impact includes the unauthorized extraction of sensitive credentials, leakage of confidential request contents and authorization headers, exposure of internal environment configurations, and the malicious modification or destruction of a victim's private request history."
}