PT-2026-23822 · Unknown · Hoppscotch

Artylobos · Published 2026-03-07 · Updated 2026-03-11 · CVE-2026-30825

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions hoppscotch versions prior to 2026.2.1

Description hoppscotch is an API development ecosystem. Prior to version 2026.2.1, the DELETE ''/v1/access-tokens/revoke'' endpoint allows any authenticated user to delete any other user's Personal Access Token (PAT) by providing its ID, without verifying ownership. The issue was addressed in version 2026.2.1.

Recommendations Update to version 2026.2.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-30825

GHSA-7PFQ-MWJ3-XW9H

Affected Products

Hoppscotch

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30825.json · Exploit
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7pfq-mwj3-xw9h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30825 · Security Note
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.1 · Note
• https://t.me/CVEtracker/46694 · Telegram Post
• https://twitter.com/CVEnew/status/2030339353164369984 · Twitter Post
• https://t.me/cveNotify/154573 · Telegram Post
• https://t.me/cveNotify/155159 · Telegram Post