Executive brief
Hoppscotch, an open-source API development platform, contained a flaw where mock servers—tools used to simulate API responses—were created as public by default. Even if a user intended to keep their API collection private, the system ignored the privacy setting during creation, making the simulated data accessible to anyone on the internet without a password. This could lead to the unintended exposure of sensitive business logic, internal data structures, or simulated credentials to unauthorized parties.
Technical details
A vulnerability in the Hoppscotch backend (specifically in `mock-server.service.ts`) causes the `isPublic` input field to be ignored during the creation of mock servers. Because the underlying Prisma database schema defaults the `isPublic` column to `true`, all newly created mock servers become publicly accessible regardless of the user's selection in the UI or GraphQL mutation. An unauthenticated attacker can access these mock endpoints via the generated subdomain to retrieve sensitive API response data linked to private collections. The issue is resolved in version 2026.6.0 by explicitly persisting the `isPublic` field and changing the default behavior to private.
Affected products
- Hoppscotch Hoppscotch < 2026.6.0
Timeline
- 2026-06-09: other: Fix developed and regression tests added
- 2026-06-30: patched: Version 2026.6.0 released
- 2026-07-01: advisory: GitHub Security Advisory published
- 2026-07-09: disclosed: CVE published to NVD