The flaw resides in the DELETE /v1/access-tokens/revoke endpoint of hoppscotch. When a user supplies the identifier of a personal access token (PAT), the system deletes that token without confirming that the token belongs to the calling user. This allows any authenticated user to invalidate another user’s PAT, which can lock the target user out of services that depend on those tokens, thereby compromising that user’s availability and potentially exposing confidential information that was accessed with the revoked token.

All installations of hoppscotch running any version prior to 2026.2.1 are affected. The vulnerability exists because the endpoint lacks an ownership verification step for the token being revoked.

Although a CVSS base score is not supplied, the absence of access control elevates the risk. The EPSS score of <1% indicates a very low probability of exploitation; however, any authenticated user who wishes to sabotage another user can do so. The vulnerability is not currently listed in CISA’s KEV catalog.