The vulnerability allows authenticated workspace members to access another member's private user data, request history, session data, and environment values through GraphQL queries. Additionally, the UserHistory service permits manipulation of history entries belonging to other users because identifiers are not bound to the requester's user ID. This results in leakage of sensitive headers and configuration, and the ability to delete or modify a victim’s request records. The weakness involves information exposure and improper access control.

Affected systems include the Hoppscotch API development ecosystem, specifically versions prior to 2026.6.0. Any deployment using an earlier release is vulnerable. The issue was discovered in the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths, and persists until the 2026.6.0 release.

The CVSS score of 7.6 indicates a high severity with the potential to compromise confidentiality and integrity of user data. Although the EPSS score is not available, the fixed version does not appear in the CISA KEV catalog, implying it has not yet been observed as a known exploit. The vulnerability is exploitable by any authenticated member of a workspace; no privilege escalation beyond workspace membership is required. Attackers simply issue the relevant GraphQL queries or use the UserHistory endpoints with a victim’s history ID.