Blinko CVE-2026-23486

The CVSS 6.9 (Medium) score reflects a network-accessible vulnerability with low attack complexity and no privilege requirements, but limited scope (information disclosure only, no integrity or availability impact). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) confirms low attack complexity and complete network accessibility. While the CVSS base score appears moderate, the real-world risk is elevated due to complete unauthenticated enumeration capability: an attacker can systematically extract all user information without authentication, facilitating credential stuffing, targeted phishing, or reconnaissance for lateral attacks. The vulnerability is trivially exploitable (low automatable impact) and patches are already available (version 1.8.4), reducing actual exploitation risk for patched deployments but creating high risk for unpatched instances. This represents a clear priority for any internet-facing Blinko deployment.

An attacker performs a simple HTTP GET request to the publicly accessible endpoint (e.g., /api/users or similar) without authentication and receives a JSON response containing all registered user accounts with their usernames, roles, and creation dates. The attacker uses this information to build a comprehensive user directory, identify administrative accounts by role, and target high-value accounts with phishing or credential stuffing attacks. The low attack complexity means no specialized tools are required beyond a basic HTTP client, making this a trivial reconnaissance vector for any external attacker.