Cross-user private data access via GraphQL IDOR

Improper authorization in Hoppscotch before 2026.6.0 allows remote authenticated users to read and alter another member's private data via GraphQL. The team GraphQL path returns teammate User objects and resolves private RESTHistory, GQLHistory, session, environment, and settings fields for that user, while toggleHistoryStarStatus and removeRequestFromHistory act on submitted history IDs without checking that userUid matches the requester. Reachability is limited to workspace members with valid accounts; once a victim's history IDs are exposed, the attacker can read sensitive request contents and authorization headers and can star or delete the victim's private history entries.