What is the CVSS score of CVE-2026-23488?

CVE-2026-23488 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Blinko are affected by CVE-2026-23488?

Organizations using Blinko should be aware of moderate risk from CVE-2026-23488, a IDOR vulnerability rated CVSS 5.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-23488?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Blinko CVE-2026-23488

EUVD-2026-14544 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-23 GitHub_M

Authentication Bypass Blinko Blinkospace

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.8.4

EUVD ID Assigned

Mar 23, 2026 - 21:00 euvd

EUVD-2026-14544

Analysis Generated

Mar 23, 2026 - 21:00 vuln.today

CVE Published

Mar 23, 2026 - 20:48 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an unauthorized access vulnerability, allowing attackers to post comments on any note (including private notes) without authorization, even if the note has not been publicly shared. The /api/v1/comment/list endpoint has the same issue, allowing unauthorized viewing of comments on all notes. This issue has been patched in version 1.8.4.

AnalysisAI

Blinko, an AI-powered card note-taking application, contains an authentication bypass vulnerability in its comment management endpoints that allows unauthenticated attackers to create and view comments on any note, including private notes that have not been publicly shared. Versions prior to 1.8.4 are vulnerable, and a patch has been released and is available via the official GitHub repository. The vulnerability has a CVSS 4.0 score of 6.9 with a network attack vector requiring no privileges or user interaction, making it trivial to exploit.

Technical ContextAI

The vulnerability exists in two API endpoints of the Blinko application (cpe:2.3:a:blinkospace:blinko:*:*:*:*:*:*:*:*): the /api/v1/comment/create and /api/v1/comment/list endpoints. These endpoints fail to properly enforce access control checks before processing requests, resulting in a CWE-639 (Authorization Bypass Through User-Controlled Key) vulnerability. The root cause is insufficient authorization validation; the application does not verify that the authenticated user (or lack thereof) has permission to interact with comments on a given note before returning data or creating new records. This is a classic broken access control issue where the API trusts client requests without server-side authorization checks.

RemediationAI

Upgrade Blinko immediately to version 1.8.4 or later, which contains the authorization bypass fixes. The patch commit (4623dd02bdeed768ffa6fea4cc2f8644cbb08c5e) is available in the repository and can be verified via https://github.com/blinkospace/blinko/commit/4623dd02bdeed768ffa6fea4cc2f8644cbb08c5e. If an immediate upgrade is not feasible, restrict network access to the Blinko API endpoints to trusted internal networks only and consider implementing a reverse proxy with request authentication enforcement. Additionally, audit logs for the /api/v1/comment/create and /api/v1/comment/list endpoints in affected versions to identify any unauthorized comment activity that may have occurred.