Blinko CVE-2026-23480

Blinko versions prior to 1.8.4. Requires any authenticated user account (low-privilege login). Attacker calls upsertUser endpoint without superAdminAuthMiddleware, omits originalPassword parameter to bypass verification, and modifies other users' passwords or escalates to superadmin. No victim interaction needed.

This vulnerability presents critical real-world risk despite the absence of a published CVSS score and EPSS value. The attack vector is network-based and requires only valid authentication (low privilege threshold), making exploitation trivial for any user with a legitimate account. The technical impact is catastrophic: complete account takeover of arbitrary users and direct privilege escalation to superadmin, which enables full system compromise. The availability of patch documentation (version 1.8.4) and public GitHub advisory (GHSA-r3mv-q7ww-86p6) indicates this is a disclosed, non-zero-day vulnerability. The low attack complexity and lack of user interaction required suggest this is highly automatable and likely already exploited in deployed instances. From an SSVC perspective, this meets criteria for immediate remediation: exploitation is straightforward, technical impact is complete, and the affected system (authentication/authorization layer) is a critical asset. Organizations must treat this as high-priority regardless of formal CVSS assignment.

An attacker with a low-privilege user account logs into a Blinko instance and directly calls the upsertUser endpoint with a crafted request containing another user's ID and a new password, omitting the originalPassword field to bypass password verification. The endpoint, lacking both superAdminAuthMiddleware and ownership validation, processes the request successfully, modifying the target user's credentials. The attacker then uses the compromised account (if it has superadmin privileges) or repeats the process against known admin accounts to achieve full administrative control. This entire attack sequence requires only network access and valid authentication, with zero user interaction, making it exploitable at scale across deployed Blinko instances.