Vulnerability · Published Mar 7, 2026 · Assigned by GitHub_M
CVE-2026-30825hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token
None 0.0
In plain English
A authorization bypass via user-controlled key in hoppscotch from hoppscotch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)0.0None
Exploit odds (30 days)0.3%top 83.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user to delete any other user's PAT by providing its ID, with no ownership verification. This issue has been patched in version 2026.2.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hoppscotch | hoppscotch | < 2026.2.1 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
References
- https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7pfq-mwj3-xw9h x_refsource_CONFIRM
- https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.1 x_refsource_MISC