Skip to main content

Hoppscotch CVE-2026-30825

NONE
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-03-07 security-advisories@github.com
Authentication Bypass Hoppscotch

Severity by source

GitHub Advisory
0.0 LOW
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
CVE Published
Mar 07, 2026 - 06:16 nvd
NONE

DescriptionGitHub Advisory

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user to delete any other user's PAT by providing its ID, with no ownership verification. This issue has been patched in version 2026.2.1.

AnalysisAI

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user to delete any other user's PAT by providing its ID, with no ownership verification.

Technical ContextAI

Classified as CWE-639 (Authorization Bypass Through User-Controlled Key). Affects Hoppscotch. hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user to delete any other user's PAT by providing its ID, with no ownership verification. This issue has been patched in version 2026.2.1.

RemediationAI

Fixed in version 2026.2.1.. Restrict network access to the affected service where possible.

More in Hoppscotch

View all
CVE-2026-50160 CRITICAL POC
10.0 Jun 23

Unauthenticated mass assignment in Hoppscotch self-hosted exposes the JWT_SECRET and SESSION_SECRET to full attacker con
CVE-2026-28215 CRITICAL POC
9.1 Feb 26

Unauthenticated infrastructure overwrite in Hoppscotch API development ecosystem before 2026.2.0. Attackers can overwrit
CVE-2023-34097 HIGH POC
8.8 Jun 05

hoppscotch is an open source API development ecosystem. Rated high severity (CVSS 8.8), this vulnerability is remotely e
CVE-2026-28216 HIGH POC
8.3 Feb 26

Hoppscotch prior to version 2026.2.0 contains authorization bypass vulnerabilities in its environment management APIs th
CVE-2026-28217 MEDIUM POC
6.5 Feb 26

hoppscotch is an open source API development ecosystem. [CVSS 6.5 MEDIUM]
CVE-2026-34847 MEDIUM POC
6.1 Apr 02

Hoppscotch prior to version 2026.3.0 contains a DOM-based open redirect vulnerability in the /enter page that allows una
CVE-2024-27092 MEDIUM POC
5.4 Feb 29

Hoppscotch is an API development ecosystem. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable
CVE-2026-34932 HIGH
8.5 Apr 02

Stored cross-site scripting (XSS) in Hoppscotch versions prior to 2026.3.0 enables remote attackers to execute arbitrary
CVE-2026-34931 HIGH
8.5 Apr 02

Open redirect in Hoppscotch API development platform prior to version 2026.3.0 enables token exfiltration leading to com
CVE-2026-34848 MEDIUM
5.4 Apr 02

Stored cross-site scripting (XSS) in Hoppscotch prior to version 2026.3.0 allows authenticated users to inject malicious

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8
CVE-2024-27730 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-30825 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy