Blinko CVE-2026-113597

Exploitation requires a valid low-privileged authenticated account (PR:L) on a Blinko instance running 1.8.8 or earlier, and is only meaningful on multi-user/shared deployments where other users' tags exist to enumerate. The specific vulnerable surface is the tag tRPC router procedures fullTagNameById, updateTagIcon, and updateTagOrder, which in the vulnerable code call prisma.tag.update with only { where: { id } } and omit the accountId ownership check (the patch adds accountId: ctx.user.id). Tag IDs are sequential, enabling trivial enumeration. Limiting factors: no special configuration is needed beyond having registered users, but single-tenant self-hosted instances have no cross-user data to expose, and impact is bounded to tag metadata (names, icons, ordering) rather than full note bodies.

This is a genuine but moderate-severity authorization flaw (CWE-639, IDOR), not a high-urgency priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) and score of 5.3 are internally consistent with the description: a network-reachable flaw requiring only a low-privileged authenticated account, with low confidentiality and low integrity impact and no availability impact. The limited impact is accurate - exposure is confined to tag metadata (names, icons, ordering) rather than full note contents, though tag names can indirectly reveal private note topics. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV, so exploitation status is 'no public exploit identified at time of analysis'; the GitHub source-code evidence supplied is the vendor patch diff (PR #1171), not weaponized exploit code. The key limiting factor the raw score understates is tenancy: the flaw is only meaningful on multi-user/shared Blinko instances, since a single-tenant self-hosted deployment has no other users' tags to enumerate. No conflicting signals were found between the CVSS vector and the description - both agree on authenticated network access with low impact.

An attacker registers or already holds a low-privileged account on a shared Blinko instance, then calls the tag tRPC procedures (fullTagNameById, updateTagIcon, updateTagOrder) while iterating sequential tag IDs that belong to other users. By reading returned tag names they infer other users' private note topics, and via updateTagIcon/updateTagOrder they tamper with those users' tag icons and ordering. No public exploit code is identified, but the sequential-ID enumeration path is explicitly described and trivial given the missing accountId ownership check.