CVE-2026-30825: 
NixOS vulnerability analysis and mitigation

CVE-2026-30825 is an Insecure Direct Object Reference (IDOR) vulnerability in Hoppscotch, an open-source API development ecosystem, that allows any authenticated user to revoke another user's Personal Access Token (PAT) without ownership verification. It affects all versions of hoppscotch-backend up to and including 2026.2.0, and was disclosed on March 5–7, 2026. The vulnerability was patched in version 2026.2.1. It carries a CVSS v3.1 base score of 6.5 (Medium) per Feedly/NVD, though the GitHub advisory assigned a lower severity rating (GitHub Advisory, Red Hat CVE).

The root cause is an Authorization Bypass Through User-Controlled Key (CWE-639), classified as an IDOR flaw. The vulnerable endpoint DELETE /v1/access-tokens/revoke in packages/hoppscotch-backend/src/access-token/access-token.controller.ts (lines 52–59) accepts a token ID as a query parameter but does not use the @GqlUser() decorator to verify that the requesting user owns the token being deleted. As a result, any authenticated user can supply an arbitrary PAT ID belonging to another user and successfully revoke it. No elevated privileges are required beyond a valid session (GitHub Advisory).

Successful exploitation allows an authenticated attacker to revoke any other user's Personal Access Token, disrupting their API access and potentially causing denial of service for automated workflows or integrations that rely on those tokens. There is no confidentiality impact (tokens are not exposed, only deleted), but the integrity impact is high as an attacker can arbitrarily invalidate authentication credentials for other users. This could be used to disrupt CI/CD pipelines, API integrations, or targeted user accounts in a shared Hoppscotch deployment (GitHub Advisory, Red Hat CVE).

A proof-of-concept is included in the GitHub security advisory itself: User B calls DELETE /v1/access-tokens/revoke?id=UserA_token_id and User A's token is immediately revoked. No exploit kits or in-the-wild exploitation have been reported. The EPSS score is approximately 0.03%, indicating a very low probability of active exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Authenticate: Obtain a valid session or authentication token for any user account on the target Hoppscotch instance (self-hosted or shared deployment).
2. Enumerate PAT IDs: Identify the target user's PAT ID. Depending on the deployment, this may be discoverable through API responses, shared logs, or by guessing/brute-forcing sequential or UUID-based identifiers.
3. Send malicious DELETE request: Issue the following HTTP request using any HTTP client (e.g., curl, Burp Suite):

   DELETE /v1/access-tokens/revoke?id=<TARGET_USER_PAT_ID>
   Authorization: Bearer <ATTACKER_SESSION_TOKEN>

4. Token revoked: The server deletes the target user's PAT without verifying ownership, immediately invalidating their API access (GitHub Advisory).

• Network: Unexpected DELETE /v1/access-tokens/revoke requests originating from user accounts that do not own the token IDs being targeted; multiple revocation requests from a single user in a short time window.
• Logs: Application logs showing PAT deletion events where the requesting user's ID does not match the token owner's user ID; repeated 200 OK responses to DELETE requests on /v1/access-tokens/revoke from a single authenticated session.
• Application Behavior: Users reporting unexpected invalidation of their Personal Access Tokens or broken API integrations without having initiated a revocation themselves (GitHub Advisory).

Upgrade hoppscotch-backend (Docker Image) to version 2026.2.1 or later, which enforces user ownership verification when deleting a PAT via the fix in pull request #5916. No configuration-based workaround is available for unpatched versions; the only effective remediation is upgrading. Organizations running self-hosted Hoppscotch instances should prioritize this patch, especially in multi-user environments (GitHub Release, GitHub Advisory).

The vulnerability was reported by security researcher artylobos and published by Hoppscotch maintainer jamesgeorge007 on March 5, 2026. A brief technical write-up was published by Infinit Security covering the IDOR nature of the flaw. Community reaction has been minimal given the low severity and limited exploitation potential, with the fix merged quickly as part of a patch release (GitHub Advisory, Infinit Security).