CVE-2026-69189

Katalog CVE KUTIM-CSIRT

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-69189

Katalog CVE

CVSS 7.6 · High EPSS 0,39%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor. Skor CVSS 3.1 7.6 (High) menurut github.com.

Deskripsi (NVD)

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0.

Rincian

Terbit di NVD
18 Agustus 2026
Terakhir diubah
16 September 2026
Status NVD
Deferred
CVSS 3.1
7.6 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-862: Missing Authorization
EPSS (30 hari)
0,39% peluang dieksploitasi; lebih tinggi dari 31,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.