What is the CVSS score of CVE-2026-23486?

CVE-2026-23486 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Blinko are affected by CVE-2026-23486?

Organizations using Blinko should be aware of moderate risk from CVE-2026-23486, a information exposure vulnerability rated CVSS 5.3. Sensitive information could be exposed to unauthorized parties.. A patch is available.

Is there a public PoC exploit available for CVE-2026-23486?

Yes, a public proof-of-concept exploit is available for CVE-2026-23486. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-23486?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Blinko CVE-2026-23486

EUVD-2026-14541 MEDIUM

Information Exposure (CWE-200)

2026-03-23 GitHub_M

Information Disclosure Blinko Blinkospace

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.8.4

EUVD ID Assigned

Mar 23, 2026 - 21:00 euvd

EUVD-2026-14541

Analysis Generated

Mar 23, 2026 - 21:00 vuln.today

CVE Published

Mar 23, 2026 - 20:42 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4.

AnalysisAI

A publicly accessible endpoint in Blinko prior to version 1.8.4 discloses sensitive user information including usernames, roles, and account creation dates without requiring authentication, allowing unauthenticated attackers to enumerate all user accounts. This information disclosure vulnerability (CWE-200) affects Blinko versions below 1.8.4 and has been patched in the latest release. The vulnerability is remotely exploitable over the network with minimal attack complexity and no privilege requirements, making it a significant privacy and enumeration risk for deployed instances.

Technical ContextAI

Blinko is an AI-powered card note-taking application built as a web service with user account management and role-based access control. The vulnerability stems from inadequate access controls on an API endpoint (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor), where user data is returned without proper authentication or authorization checks. The affected component is identified via CPE as cpe:2.3:a:blinkospace:blinko:*:*:*:*:*:*:*:* for all versions prior to 1.8.4. The root cause is a failure to implement proper authentication middleware or endpoint-level access controls, allowing the application to leak user metadata that should be restricted to authenticated and authorized users only.

RemediationAI

Immediately upgrade Blinko to version 1.8.4 or later, which includes the security patch. The specific remediation commit is available at https://github.com/blinkospace/blinko/commit/ec1e3e20384b620b8bf928fe80b4d8546757b419. For environments unable to patch immediately, implement network-level access controls by restricting HTTP access to the vulnerable endpoint to trusted IP ranges only, or place the Blinko instance behind an authentication proxy that requires valid credentials before allowing any requests. Additionally, audit server logs to determine if the endpoint has been accessed by unauthorized parties and monitor for any suspicious user enumeration activity. Once patching is feasible, apply version 1.8.4 or later and verify the patch via the referenced security advisory at https://github.com/blinkospace/blinko/security/advisories/GHSA-446p-2xf5-frxf.