EUVD-2026-71231
GHSA-vjwr-9399-cmx7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR exploitable by any authenticated user with no complexity or user interaction; confidentiality-only impact, no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes including attachments and tags.
AnalysisAI
Cross-user private note disclosure in Blinko 1.8.7 allows any authenticated user to read other users' private notes, attachments, and tags by exploiting a missing ownership check in the noteReferenceList TRPC procedure. The flaw follows a classic IDOR pattern (CWE-639): the API accepts sequential note identifiers without verifying the caller's entitlement to access them, enabling systematic enumeration of the entire note corpus. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated user account (confirmed by PR:L in the CVSS 4.0 vector) on a multi-user Blinko instance running version 1.8.7 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately reflects a realistic threat profile: low-complexity network exploitation requiring only a valid user account, with high confidentiality impact and no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Blinko to version 1.8.8 or later, where ownership verification was added to the noteReferenceList procedure in server/routerTrpc/note.ts (https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/note.ts). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Blinko 1.8.7 and audit recent access logs for noteReferenceList API calls to identify potential unauthorized access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Blinko, an AI-powered card note-taking application, contains a path traversal vulnerability in its file server endpoint
A publicly accessible endpoint in Blinko prior to version 1.8.4 discloses sensitive user information including usernames
Blinko versions 1.8.3 and earlier contain a path traversal vulnerability in the plugin file server endpoint that fails t
Blinko versions prior to 1.8.4 contain a critical privilege escalation vulnerability in the upsertUser endpoint that all
Insecure Direct Object Reference (IDOR) in Blinko 1.8.7 allows any authenticated user to read, modify, and delete AI cha
Blinko versions prior to 1.8.4 allow authenticated high-privilege users to execute arbitrary commands through the MCP se
An Insecure Direct Object Reference (IDOR) vulnerability in Blinko versions prior to 1.8.4 allows authenticated attacker
Blinko versions 1.8.3 and earlier allow authenticated users to write arbitrary files to the filesystem through an unvali
Blinko, an AI-powered card note-taking application, contains an authenticated arbitrary file write vulnerability in the
Blinko, an AI-powered card note-taking application, contains a path traversal vulnerability in the filePath parameter th
Blinko, an AI-powered card note-taking application, contains an authentication bypass vulnerability in its comment manag
Share
External POC / Exploit Code
Leaving vuln.today