AUGUST 24, 2026
Live Feed
Back to database
Case File

CVE-2026-59720

HIGH · CVSS 7.5 EPSS 0.34% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-09 · Last synced 2026-08-08

CyberRota Analysis

AI-Generated

The vulnerability in Hoppscotch allows mock servers linked to private collections to be publicly accessible due to a failure to persist the isPublic input field, which defaults to true. This can lead to the unintended exposure of sensitive API data without authentication. Organizations using versions prior to 2026.6.0 should prioritize updating to the latest version to mitigate the risk of unauthorized data access.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-59720
Severity
HIGH
CVSS
7.5
EPSS
0.34%

Original NVD Description

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without authentication and potentially expose sensitive API data. This issue is fixed in version 2026.6.0.