CVE-2026-30825: hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user to delete any other user's PAT by providing its ID, with no ownership verification. This issue has been patched in version 2026.2.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30825?
CVE-2026-30825 is a high-severity vulnerability due to its potential for unauthorized access and manipulation of user access tokens.
How do I fix CVE-2026-30825?
To fix CVE-2026-30825, update your hoppscotch installation to version 2026.2.1 or later.
Who is affected by CVE-2026-30825?
Any authenticated users of hoppscotch prior to version 2026.2.1 are affected by CVE-2026-30825.
What does CVE-2026-30825 allow an attacker to do?
CVE-2026-30825 allows an authenticated user to revoke another user's Personal Access Token without their consent.
Is CVE-2026-30825 a critical issue for hoppscotch users?
Yes, CVE-2026-30825 is considered a critical issue as it compromises user account security through unauthorized token revocation.