None severity0.0NVD Advisory· Published Mar 7, 2026· Updated Jun 17, 2026
CVE-2026-30825
CVE-2026-30825
Description
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user to delete any other user's PAT by providing its ID, with no ownership verification. This issue has been patched in version 2026.2.1.
Affected products
3cpe:2.3:a:hoppscotch:hoppscotch:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:hoppscotch:hoppscotch:*:*:*:*:*:*:*:*range: <2026.2.1
- (no CPE)range: <2026.2.1
- (no CPE)range: < 2026.2.1
Patches
Vulnerability mechanics
References
2- github.com/hoppscotch/hoppscotch/security/advisories/GHSA-7pfq-mwj3-xw9hnvdVendor Advisory
- github.com/hoppscotch/hoppscotch/releases/tag/2026.2.1nvdProductRelease Notes
News mentions
0No linked articles in our index yet.