CVE-2026-69189

Name of the Vulnerable Software and Affected Versions Hoppscotch versions prior to 2026.6.0

Description An authenticated workspace member can access private user data of other members through several GraphQL paths, including team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings. Additionally, the UserHistory service contains functions toggleHistoryStarStatus() and removeRequestFromHistory() that do not verify userUid ownership when processing history identifiers. This allows an attacker to read private request history, session data, request contents, authorization headers, environment values, and settings, as well as modify or delete the private history entries of other users.

Recommendations Update to version 2026.6.0.