CVE Explorer

CVE-2026-50160

Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped and are iterated in the service layer as if they were legitimate InfraConfig entries. Because keys s

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:5412d957c4f31a85e628cb1fcbd392be71d70fd0be6747c9ef5360d5e7bc197f

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"hoppscotch","vendor":"hoppscotch","versions":[{"status":"affected","version":"<= 2026.4.1"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:5f3ed86434f22f2d0dc68d70311c03eb973eea1c30073b16ce6e725565d2e1e4 · sha256:35dbf521c878246b… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:5f3ed86434f22f2d0dc68d70311c03eb973eea1c30073b16ce6e725565d2e1e4 · sha256:35dbf521c878246b… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-915","description":"CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:5f3ed86434f22f2d0dc68d70311c03eb973eea1c30073b16ce6e725565d2e1e4 · sha256:35dbf521c878246b… · /containers/cna/problemTypes/0/descriptions/0

Source references

4 source assertions

{"url":"http://www.openwall.com/lists/oss-security/2026/06/23/7"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5f3ed86434f22f2d0dc68d70311c03eb973eea1c30073b16ce6e725565d2e1e4 · sha256:35dbf521c878246b… · /containers/adp/0/references/0

{"name":"https://github.com/hoppscotch/hoppscotch/pull/6171","tags":["x_refsource_MISC"],"url":"https://github.com/hoppscotch/hoppscotch/pull/6171"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5f3ed86434f22f2d0dc68d70311c03eb973eea1c30073b16ce6e725565d2e1e4 · sha256:35dbf521c878246b… · /containers/cna/references/1

{"tags":["exploit"],"url":"https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5f3ed86434f22f2d0dc68d70311c03eb973eea1c30073b16ce6e725565d2e1e4 · sha256:35dbf521c878246b… · /containers/adp/1/references/0

{"name":"https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf","tags":["x_refsource_CONFIRM"],"url":"https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5f3ed86434f22f2d0dc68d70311c03eb973eea1c30073b16ce6e725565d2e1e4 · sha256:35dbf521c878246b… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer