CVE-2026-30825: hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user…

PriorityP338medium6.5CVSS 3.1

AVNACLPRLUINSUCNIHAN

EPSS

0.22%

13.1th percentile

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user to delete any other user's PAT by providing its ID, with no ownership verification. This issue has been patched in version 2026.2.1.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
hoppscotch	hoppscotch	< 2026.2.1	2026.2.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.