EUVD-2026-14529Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability. The upsertUser endpoint has 3 issues: it is missing superAdminAuthMiddleware, any logged-in user can call it; the originalPassword is an optional parameter and if not provided password verification is skipped; there is no check for input.id === ctx.id (ownership verification). This could result in any authenticated user modifying other users' passwords, direct escalation to superadmin, and complete account takeover. This issue has been patched in version 1.8.4.
AnalysisAI
Blinko versions prior to 1.8.4 contain a critical privilege escalation vulnerability in the upsertUser endpoint that allows any authenticated user to modify other users' passwords and escalate to superadmin privileges. The vulnerability stems from three distinct authorization and input validation flaws: missing superAdminAuthMiddleware enforcement, optional password verification, and absent ownership checks. An attacker with valid credentials can directly execute account takeover and administrative privilege escalation with no additional exploits required.
Technical ContextAI
Blinko is an AI-powered card note-taking application (identified via CPE cpe:2.3:a:blinkospace:blinko:*:*:*:*:*:*:*:*) that implements user management functionality through an upsertUser endpoint. The vulnerability root cause maps to CWE-288 (Authentication Bypass Using an Alternate Path or Channel) combined with broken access control patterns. The endpoint fails to enforce middleware-based authorization checks that should validate superadmin status before allowing user mutations. Additionally, the endpoint's optional originalPassword parameter creates a password-bypass condition where the authentication verification logic is skipped entirely if the parameter is absent. The absence of input.id === ctx.id (user context) verification means the endpoint does not validate that the requesting user owns the account being modified, allowing cross-user account manipulation.
RemediationAI
Immediately upgrade Blinko to version 1.8.4 or later, which patches all three authorization and input validation flaws in the upsertUser endpoint. The patch restores superAdminAuthMiddleware enforcement, implements mandatory originalPassword verification, and adds ownership checks (input.id === ctx.id validation). Refer to the official GitHub security advisory at https://github.com/blinkospace/blinko/security/advisories/GHSA-r3mv-q7ww-86p6 for detailed patch information and verification steps. Until patching is complete, implement network-level access controls to restrict Blinko instance access to trusted users and IP ranges, audit recent user modification logs for signs of unauthorized privilege escalation, and reset passwords for all superadmin accounts as a precautionary measure. Verify the patch deployment by confirming the installed version matches 1.8.4 or higher.
Blinko, an AI-powered card note-taking application, contains a path traversal vulnerability in its file server endpoint
A publicly accessible endpoint in Blinko prior to version 1.8.4 discloses sensitive user information including usernames
Blinko versions 1.8.3 and earlier contain a path traversal vulnerability in the plugin file server endpoint that fails t
Insecure Direct Object Reference (IDOR) in Blinko 1.8.7 allows any authenticated user to read, modify, and delete AI cha
Blinko versions prior to 1.8.4 allow authenticated high-privilege users to execute arbitrary commands through the MCP se
Cross-user private note disclosure in Blinko 1.8.7 allows any authenticated user to read other users' private notes, att
An Insecure Direct Object Reference (IDOR) vulnerability in Blinko versions prior to 1.8.4 allows authenticated attacker
Blinko versions 1.8.3 and earlier allow authenticated users to write arbitrary files to the filesystem through an unvali
Blinko, an AI-powered card note-taking application, contains an authenticated arbitrary file write vulnerability in the
Blinko, an AI-powered card note-taking application, contains a path traversal vulnerability in the filePath parameter th
Blinko, an AI-powered card note-taking application, contains an authentication bypass vulnerability in its comment manag
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today