Vulnerability in Hoppscotch occurs because the mock‑server component does not store the isPublic flag supplied during creation. The underlying database defaults this flag to true, meaning mock servers that belong to private collections become accessible to anyone who can reach the mock‑server endpoint. An attacker can retrieve the complete API response structure for those private collections, exposing potentially sensitive data, credentials, or other confidential information.

Hoppscotch, the open‑source API development ecosystem, is affected. Any installation running a version older than 2026.6.0 is vulnerable when mock servers are created in private collections, regardless of the intended visibility setting.

The CVSS base score of 7.5 indicates a high severity. The EPSS score of < 1% indicates a low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities. The attack vector is straightforward: a user can simply use the publicly exposed mock‑server URL to retrieve data, making exploitation trivial once a vulnerable mock server is created.