What is the CVSS score of CVE-2026-23487?

CVE-2026-23487 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Blinko are affected by CVE-2026-23487?

Organizations using Token. This issue has been patched in should be aware of notable risk from CVE-2026-23487, a IDOR vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-23487?

Within 30 days: Identify affected systems running Token. This issue has been patched in and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Blinko CVE-2026-23487

EUVD-2026-14543 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-23 GitHub_M

Authentication Bypass Blinko Blinkospace

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.8.4

EUVD ID Assigned

Mar 23, 2026 - 21:00 euvd

EUVD-2026-14543

Analysis Generated

Mar 23, 2026 - 21:00 vuln.today

CVE Published

Mar 23, 2026 - 20:45 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an IDOR vulnerability where user.detail Endpoint Leaks the Superadmin Token. This issue has been patched in version 1.8.4.

AnalysisAI

An Insecure Direct Object Reference (IDOR) vulnerability in Blinko versions prior to 1.8.4 allows authenticated attackers to leak the superadmin token through the user.detail endpoint by manipulating user identifiers. This authentication bypass vulnerability has a CVSS score of 6.0 and affects the Blinko AI-powered note-taking application. A patch is available in version 1.8.4, and proof-of-concept information is available via the official GitHub security advisory.

Technical ContextAI

Blinko (cpe:2.3:a:blinkospace:blinko:*:*:*:*:*:*:*:*) is an AI-powered card note-taking application that implements a REST API user detail endpoint. The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), where the user.detail endpoint fails to properly validate whether the authenticated user has permission to access another user's sensitive data, specifically the superadmin authentication token. The endpoint accepts user identifiers as input parameters without performing adequate access control checks, allowing attackers with any valid user account (PR:L privilege requirement) to enumerate and retrieve tokens belonging to administrative accounts by simply changing the target user identifier.

RemediationAI

Immediately upgrade Blinko to version 1.8.4 or later, which patches the IDOR vulnerability in the user.detail endpoint. The patched version is available at https://github.com/blinkospace/blinko/releases/tag/1.8.4. For organizations unable to upgrade immediately, implement network-level access controls to restrict API endpoint access to trusted internal IP ranges only, enforce mutual TLS authentication on the user.detail endpoint if possible, and monitor authentication logs for suspicious token access patterns. Additionally, consider rotating any superadmin tokens that may have been exposed prior to patching, and audit API access logs for evidence of IDOR exploitation attempts.