Medium severity · published Mar 7, 2026
CVE-2026-30825
hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user to delete any other user's PAT by providing its ID, with no ownership verification. This issue has been patched in version 2026.2.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
hoppscotch · hoppscotch
< 2026.2.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-30825
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-30825
Product
https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.1
Vendor Advisory
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7pfq-mwj3-xw9h
More from hoppscotch
10.0
CVE-2026-50160
Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
9.6
CVE-2026-34931
hoppscotch: Improper loopback redirect_uri validation in device-login flow
9.3
CVE-2026-34932
hoppscotch: Stored XSS via mock server responses on backend origin
9.1
CVE-2026-28215
hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover
8.8
CVE-2023-34097
Database password exposed in logs in hoppscotch