CVE-2026-69189

Executive Summary

CVE-2026-69189 is a broken object-level authorization (IDOR) vulnerability in Hoppscotch, the open-source API development ecosystem, affecting all versions prior to 2026.6.0. An authenticated user who is a member of a workspace can query multiple GraphQL paths — including team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings — to read another workspace member's private user data, and can use the toggleHistoryStarStatus and removeRequestFromHistory operations in the UserHistory service to modify or delete the victim's private history entries. The issue has a CVSS score of 7.6 (High), driven predominantly by High confidentiality impact; exploitation requires only low-privileged authenticated access with no user interaction.

Technical Analysis

The vulnerability class is insecure direct object reference (IDOR), also known as broken object-level authorization (BOLA). Hoppscotch is a GraphQL-driven application that supports multi-user workspaces. The flaw is rooted in the authorization boundary: the application appears to validate that a caller is a member of a given workspace, but fails to enforce object-level ownership based on the caller's userUid when resolvers return user-scoped data.

Two distinct flaws are described in the NVD description:

1. Unauthorized read of private user data via GraphQL query paths. The query paths team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings expose another workspace member's private User data. In a correctly implemented multi-tenant GraphQL API, each of these resolvers should scope results to the authenticated caller's user identity. The description indicates this scoping is absent, so an authenticated workspace member can resolve these fields for other members and retrieve private request history, session data, request contents, authorization headers, environment values, and user settings.

2. Unauthorized modification/deletion via UserHistory service mutations. The operations toggleHistoryStarStatus and removeRequestFromHistory accept a history identifier belonging to another user. The service does not enforce that the supplied history identifier is owned by the requesting userUid. This permits an attacker to modify the star state of a victim's private history entry or delete the entry outright.

The attack surface is the application's GraphQL API, which is reachable over the network. The CVSS vector confirms the relevant properties: AV:N (network-reachable), AC:L (no special conditions), PR:L (attacker needs only a low-privileged account, such as a workspace member), UI:N (no user interaction), S:U (no scope change), with C:H (high confidentiality), I:L (low integrity), and A:L (low availability). No public exploit code, Nuclei template, or PoC is available, and the CVE is not listed in CISA KEV. EPSS has not yet scored this CVE. The vulnerability mechanism is entirely attributable to missing server-side ownership checks rather than a memory-safety or injection flaw; no crafted payload beyond a GraphQL document referencing another user's identifiers is required.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the affected paths named in the NVD description.

1. Reconnaissance / target identification. The attacker obtains valid credentials for a low-privileged account in a Hoppscotch workspace (for example, a regular workspace member). The attacker identifies the application's GraphQL API and enumerates workspace member identifiers via the team and teamMembers.user paths, which also appear to be affected by the missing ownership enforcement.

2. Flaw trigger. The attacker issues crafted GraphQL queries that select sensitive user-scoped fields using another member's identifier. Affected fields include RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings. Alternatively, the attacker invokes the toggleHistoryStarStatus or removeRequestFromHistory mutation using a victim's history identifier.

3. Execution mechanism. Because the server does not enforce userUid ownership on these resolvers and mutation handlers, the GraphQL API returns the victim's private data or acts on the victim's history records. No injection payload is needed — the weakness is purely a missing authorization check at the object level. The request is a legitimate authenticated GraphQL request; the server's response contains data or state changes belonging to another user.

4. Post-exploitation impact. Harvested authorization headers, raw request contents, session data, and environment values can be reused against the victim's upstream APIs, enabling credential theft, session hijacking, and lateral movement into downstream systems. The attacker can additionally modify or delete the victim's private history entries, causing data integrity loss and destroying records that may be needed for audit or operational continuity.

Impact Assessment

The primary business impact is a severe loss of confidentiality for any organization running a multi-user Hoppscotch instance below 2026.6.0. Hoppscotch users routinely store real API requests, live session data, and environment values inside the tool; these often contain live authorization headers (Bearer tokens, API keys) and other secrets. An attacker with a low-privileged workspace account can silently harvest every member's request history and environment configuration, enabling downstream compromise of the victim organization's actual API estate.

The CVSS subscores quantify this clearly: C:H reflects the direct exposure of private user data and embedded secrets; I:L reflects the ability to toggle star states on a victim's history entries; A:L reflects the ability to delete a victim's private history entries, removing records the victim relies on. The scope is unchanged (S:U), meaning the compromise does not extend to other components of the host, but the data affected is entirely user-owned.

The blast radius is limited to Hoppscotch instances with more than one user per workspace; single-user instances and instances with strictly single-member workspaces provide limited attack value. However, self-hosted deployments used as shared team tooling, or SaaS-like deployments with many tenants in one workspace, expose all workspace members to the flaw. Depending on jurisdiction, the exposure of stored credentials and user-generated request data may trigger data-breach notification obligations under GDPR or similar regulations.

Detection Guidance

Because no exploit code is public, detection focuses on anomalous GraphQL traffic that references the sensitive user-scoped fields named in the CVE, repeated cross-user object references, and mutations that target history identifiers. The rules below assume that HTTP request bodies are logged or inspected; GraphQL payloads are usually JSON over POST.

Sigma Rule

title: Hoppscotch GraphQL IDOR Sensitive Field Access Attempt (CVE-2026-69189)
id: 8f1a2b3c-4d5e-4f6a-9b8c-7a6b5c4d3e2f
status: experimental
description: Detects HTTP POST requests to a Hoppscotch GraphQL endpoint that reference sensitive user-scoped fields (RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, globalEnvironments) or the UserHistory mutations (toggleHistoryStarStatus, removeRequestFromHistory) associated with CVE-2026-69189 broken object-level authorization.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-69189
author: Valters IT Threat Intelligence
date: 2026/06/15
tags:
    - attack.t1190
    - cve.2026-69189
    - cwe.200
logsource:
    category: webserver
    product: generic
detection:
    selection_endpoint:
        cs-method: POST
        cs-uri-path|contains: graphql
    selection_read_fields:
        cs-body|contains:
            - 'RESTHistory'
            - 'GQLHistory'
            - 'currentRESTSession'
            - 'currentGQLSession'
            - 'globalEnvironments'
    selection_write_fields:
        cs-body|contains:
            - 'removeRequestFromHistory'
            - 'toggleHistoryStarStatus'
    condition: selection_endpoint and (selection_read_fields or selection_write_fields)
falsepositives:
    - Legitimate GraphQL operations by users accessing their own history and session objects
    - GraphQL schema introspection and API development tooling that mirrors all available fields
level: high

YARA Rule

rule CVE_2026_69189_Hoppscotch_GraphQL_IDOR
{
    meta:
        author = "Valters IT Threat Intelligence"
        date = "2026-06-15"
        cve = "CVE-2026-69189"
        cwe = "CWE-200"
        description = "Detects HTTP request bodies, web server logs, or packet captures containing Hoppscotch GraphQL fields abused by CVE-2026-69189 for cross-user data access or history modification."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-69189"
    strings:
        $f_rest = "RESTHistory" ascii nocase
        $f_gql = "GQLHistory" ascii nocase
        $f_rest_sess = "currentRESTSession" ascii nocase
        $f_gql_sess = "currentGQLSession" ascii nocase
        $f_env = "globalEnvironments" ascii nocase
        $m_star = "toggleHistoryStarStatus" ascii nocase
        $m_remove = "removeRequestFromHistory" ascii nocase
        $key_uid = "userUid" ascii nocase
    condition:
        any of ($m_*) or (2 of ($f_rest, $f_gql, $f_rest_sess, $f_gql_sess, $f_env) and $key_uid)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-69189 Hoppscotch GraphQL IDOR - sensitive field access"; flow:to_server,established; content:"POST"; http_method; content:"graphql"; http_uri; content:"RESTHistory"; http_request_body; sid:2026069150; rev:1; classtype:attempted-recon; reference:cve,2026-69189;)
alert http any any -> $HOME_NET any (msg:"CVE-2026-69189 Hoppscotch UserHistory mutation abuse"; flow:to_server,established; content:"POST"; http_method; content:"graphql"; http_uri; content:"removeRequestFromHistory"; http_request_body; sid:2026069151; rev:1; classtype:attempted-user; reference:cve,2026-69189;)
alert http any any -> $HOME_NET any (msg:"CVE-2026-69189 Hoppscotch UserHistory star toggle abuse"; flow:to_server,established; content:"POST"; http_method; content:"graphql"; http_uri; content:"toggleHistoryStarStatus"; http_request_body; sid:2026069152; rev:1; classtype:attempted-user; reference:cve,2026-69189;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.category == "network" and network.protocol == "http"
    and http.request.method == "POST"
    and http.request.body.content like "*RESTHistory*"
    and http.request.body.content like "*userUid*" ]
  [ network where event.category == "network" and network.protocol == "http"
    and http.request.method == "POST"
    and (http.request.body.content like "*GQLHistory*"
         or http.request.body.content like "*currentRESTSession*"
         or http.request.body.content like "*currentGQLSession*"
         or http.request.body.content like "*removeRequestFromHistory*"
         or http.request.body.content like "*toggleHistoryStarStatus*") ]

Splunk SPL Query

index=web sourcetype=access_combined
  method=POST uri_path="/graphql"
| rex field=_raw "(?<gql_field>RESTHistory|GQLHistory|currentRESTSession|currentGQLSession|globalEnvironments|removeRequestFromHistory|toggleHistoryStarStatus)"
| search gql_field=*
| eval cross_user=if(match(_raw,"userUid"),"possible-cross-user-reference","user-scoped-field")
| stats values(gql_field) AS gql_fields, dc(gql_field) AS distinct_fields, count AS request_count by src_ip, user, cross_user
| where distinct_fields >= 2
| sort - request_count

Wazuh OSSEC Rule

<group name="web,hoppscotch,">
  <rule id="100691" level="12">
    <decoded_as>web</decoded_as>
    <field name="method">POST</field>
    <field name="url">graphql</field>
    <regex>RESTHistory|GQLHistory|currentRESTSession|currentGQLSession|globalEnvironments|removeRequestFromHistory|toggleHistoryStarStatus</regex>
    <description>CVE-2026-69189 - Hoppscotch GraphQL IDOR attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>hoppscotch,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED) according to the provided tracking data — no vendor advisory has been corroborated by tracked patch sources, even though the NVD description states the issue is fixed in version 2026.6.0. Organizations should treat affected instances as vulnerable until the fix is verified independently from Hoppscotch's official release notes or security advisory.

1. Immediate mitigations. Restrict network access to the Hoppscotch GraphQL API to trusted IP ranges or a VPN; review active workspace members and remove unnecessary low-privilege accounts; require strong multi-factor authentication for all workspace members; deploy WAF or reverse-proxy rules that inspect GraphQL request bodies for the sensitive field names and mutation names listed above; enable verbose application and web-server logging so that GraphQL queries and responses are auditable; and, if multi-user workspaces are not business-critical, restrict the instance to single-user use until patched.

2. Patch/upgrade steps. Verify the vendor's advisory and release notes, then upgrade Hoppscotch to version 2026.6.0 or later, which the NVD description identifies as the fixed release. Before upgrading, back up the application database, including all request histories and environment settings. After upgrade, perform regression testing of GraphQL authorization: create two test users in one workspace and confirm that each user's RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings are isolated, and that toggleHistoryStarStatus and removeRequestFromHistory reject identifiers owned by another user. Rotate all credentials and secret values that may have been stored in request history or environments, since they may already have been exposed.

3. Long-term hardening. Adopt object-level authorization testing (OWASP API Security Top 10 — API1:2023 Broken Object Level Authorization) as a standard step for all GraphQL resolvers and mutations; enforce server-side userUid ownership checks on every user-scoped object, independent of client-supplied identifiers; implement automated security scanning of GraphQL schemas; subscribe to Hoppscotch security advisories; and routinely audit access logs for anomalous cross-user GraphQL queries. For any secrets that must be stored inside Hoppscotch environments, integrate with a secrets manager rather than storing raw credentials in plain text.

References

1. NVD entry — https://nvd.nist.gov/vuln/detail/CVE-2026-69189
2. Hoppscotch official GitHub repository — https://github.com/hoppscotch/hoppscotch
3. Hoppscotch releases / changelog (verify 2026.6.0 fix) — https://github.com/hoppscotch/hoppscotch/releases
4. CISA Known Exploited Vulnerabilities — not listed (no known exploitation in the wild at the time of writing)
5. No threat actor campaigns, public PoC, or exploit-in-the-wild evidence has been reported for CVE-2026-69189 as of this report.