Blinko CVE-2026-85624

Exploitation requires an authenticated user account (confirmed by PR:L in the CVSS 4.0 vector) on a multi-user Blinko instance running version 1.8.7 or earlier. The attacker must be able to reach the TRPC API endpoint over the network (AV:N). Sequential note ID assignment makes enumeration trivial without brute-force guessing. No special privileges beyond a basic registered login, no non-default configuration, and no user interaction from a victim are needed. Single-user Blinko deployments where no other users' notes exist are not at risk of cross-user disclosure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately reflects a realistic threat profile: low-complexity network exploitation requiring only a valid user account, with high confidentiality impact and no integrity or availability consequences. The absence of a KEV listing and public exploit code reduces immediate urgency, though the trivial exploitation path - sequential IDs enumerable with any HTTP client - means no specialized tooling is required; even a mid-sized organization running a shared Blinko instance in kielce should treat this as urgent until upgrading. The low public-exploit signal likely reflects Blinko's niche footprint rather than low exploitability. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be independently quantified. Single-user or air-gapped deployments are not at meaningful cross-user risk.

An attacker with a low-privilege Blinko account creates a test note and observes that its assigned ID is sequential (e.g., ID 150). The attacker then calls the noteReferenceList endpoint iterating IDs 1 through 149, receiving full content - text, attachments, and tags - from other users' private notes with no server-side rejection. A simple loop using any HTTP client is sufficient; no exploit framework or specialized tooling is required.