PT-2026-23822 · Unknown · Hoppscotch

Artylobos · Publicado 2026-03-07 · Atualizado 2026-03-11 · CVE-2026-30825

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions hoppscotch versions prior to 2026.2.1

Description hoppscotch is an API development ecosystem. Prior to version 2026.2.1, the DELETE ''/v1/access-tokens/revoke'' endpoint allows any authenticated user to delete any other user's Personal Access Token (PAT) by providing its ID, without verifying ownership. The issue was addressed in version 2026.2.1.

Recommendations Update to version 2026.2.1 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-30825

GHSA-7PFQ-MWJ3-XW9H

Produtos afetados

Hoppscotch

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30825.json · Exploit
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7pfq-mwj3-xw9h · Aviso do Fabricante
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.1 · Nota
• https://t.me/CVEtracker/46694 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2030339353164369984 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30825 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30825 · Nota de Segurança
• https://t.me/cveNotify/154573 · Publicação no Telegram
• https://t.me/cveNotify/155159 · Publicação no Telegram