Is CVE-2026-59720 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59720 being exploited in the wild.

How severe is CVE-2026-59720?

High severity, with a CVSS score of 7.5, published 9 July 2026.

Is there a fix for CVE-2026-59720?

A patch was published on 2026-06-30: Version 2026.6.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59720 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-59720?

Check whether you run Hoppscotch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59720: Hoppscotch insecure default configuration in mock server creation

CVE-2026-59720 · Severity: high · CVSS 7.5 · Published 2026-07-09

Hoppscotch, an open-source API development platform, contained a flaw where mock servers—tools used to simulate API responses—were created as public by default. Even if a user intended to keep their API collection private, the system ignored the privacy setting during creation, making the simulated data accessible to anyone on the internet without a password. This could lead to the unintended exposure of sensitive business logic, internal data structures, or simulated credentials to unauthorized parties.

Technologies: Hoppscotch. Vendors: Hoppscotch.

Quick answers

Is CVE-2026-59720 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59720 being exploited in the wild.
How severe is CVE-2026-59720?: High severity, with a CVSS score of 7.5, published 9 July 2026.
Which products and versions are affected?: Hoppscotch < 2026.6.0.
Is there a fix for CVE-2026-59720?: A patch was published on 2026-06-30: Version 2026.6.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59720 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-59720?: Check whether you run Hoppscotch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the Hoppscotch backend (specifically in `mock-server.service.ts`) causes the `isPublic` input field to be ignored during the creation of mock servers. Because the underlying Prisma database schema defaults the `isPublic` column to `true`, all newly created mock servers become publicly accessible regardless of the user's selection in the UI or GraphQL mutation. An unauthenticated attacker can access these mock endpoints via the generated subdomain to retrieve sensitive API response data linked to private collections. The issue is resolved in version 2026.6.0 by explicitly persisting the `isPublic` field and changing the default behavior to private.

Affected products

Hoppscotch Hoppscotch < 2026.6.0

Timeline

2026-06-09: other: Fix developed and regression tests added
2026-06-30: patched: Version 2026.6.0 released
2026-07-01: advisory: GitHub Security Advisory published
2026-07-09: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.