EUVD-2026-71223
GHSA-2rx6-45h4-gf4q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Blinko with any valid account
-
DeliveryCall message.list tRPC with sequentially enumerated integer IDs
-
ExploitIdentify message and conversation IDs belonging to other users
-
ExecutionRead victim's full AI chat history
-
PersistOptionally call message.update to tamper with content
-
ImpactCall conversation.clearMessages or message.clearAfter to permanently wipe victim's data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | A valid Blinko user account is required - exploitation is not possible without authentication (PR:L). The deployment must be multi-user; single-user instances have no other accounts to target. No non-default configuration is needed: the vulnerability is present in the standard tRPC API as shipped. Sequential integer IDs eliminate any guessing requirement, meaning there is no brute-force barrier. The tRPC endpoint must be reachable over the network, which is the default for any networked Blinko deployment. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) yields an 8.7 score, reflecting low attack complexity and full triad impact against the vulnerable system, with the only meaningful constraint being a required authenticated session (PR:L). This is not a case of CVSS inflation: the impact ratings are accurate - an attacker can exfiltrate the full AI chat history of any user (C:H), overwrite message content (I:H), and permanently wipe conversations (A:H). The flaw is not in the KEV catalog and no POC code has been explicitly referenced, but the sequential integer ID design makes this vulnerability effectively self-documenting and trivially exploitable by any account holder. Real-world risk is highest in multi-tenant or shared Blinko deployments (self-hosted teams, hosted instances) where user data isolation is an explicit expectation. Single-user self-hosted instances face no meaningful cross-account risk. EPSS data was not provided. The absence of any attack complexity or precondition beyond account registration makes this a genuine priority for multi-user operators despite no confirmed active exploitation. |
| Exploit ScenarioDerived | An attacker with a valid Blinko account iterates integer IDs starting from 1 in calls to the message.list tRPC procedure to retrieve other users' full AI conversation histories. Once a target's conversation ID is identified, the attacker issues message.update requests to alter message content or calls conversation.clearMessages to permanently destroy the victim's data. No special tooling is required; standard HTTP clients or browser developer tools suffice to call tRPC endpoints directly. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Insecure Direct Object Reference (IDOR) in Blinko 1.8.7 allows any authenticated user to read, modify, and delete AI chat history belonging to other accounts by supplying arbitrary sequential integer IDs to five tRPC API procedures. The affected endpoints - message.list, message.update, message.delete, message.clearAfter, and conversation.clearMessages - enforce authentication but perform no ownership verification against the caller's identity before querying the database. Version 1.8.8 appears to resolve the issue based on GitHub references pointing to corrected source files; no public exploit code has been identified at time of analysis.
RemediationAI
Upgrade Blinko to version 1.8.8 or later, which contains corrected implementations of the affected tRPC procedures as confirmed by the GitHub 1.8.8 tag references (https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/message.ts, https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/conversation.ts). If an immediate upgrade is not feasible, operators of multi-user deployments should consider restricting Blinko to a single trusted user account per instance as a compensating control, effectively eliminating cross-account risk at the cost of multi-user functionality. Network-level access controls (e.g., placing Blinko behind a VPN or requiring authenticated reverse-proxy sessions) do not mitigate the IDOR since the flaw is post-authentication. The full VulnCheck advisory is available at https://www.vulncheck.com/advisories/blinko-1.8.7-cross-user-ai-conversation-read-and-write-via-message-trpc-router.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Blinko is an open-source AI-powered note-taking and conversation application developed by blinkospace. Its backend API is built on tRPC, a TypeScript end-to-end type-safe RPC framework that maps procedure calls directly to server-side handlers. The vulnerable procedures reside in two router files: server/routerTrpc/message.ts (handling per-message operations) and server/routerTrpc/conversation.ts (handling conversation-level operations). CWE-639 (Authorization Bypass Through User-Controlled Key) captures the root cause: the procedures accept a caller-supplied integer ID as the sole selector for database queries without asserting that the identified resource belongs to the authenticated session. Because Blinko assigns sequential integer IDs to messages and conversations, enumeration across user accounts requires no guessing - simple incrementing iteration is sufficient. The CPE cpe:2.3:a:blinkospace:blinko:*:*:*:*:*:*:*:* with a wildcard version field indicates the affected range has not been precisely bounded in NVD, but the GitHub fix references tag 1.8.8.
Know when Blinko gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-accessible tRPC API requires only a valid session (PR:L, AV:N, AC:L); full read/write/delete impact on victim data across all three pillars (C:H/I:H/A:H); no scope change as impact is confined to Blinko user data.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts). Although these procedures require authentication, they query the database by caller-supplied conversation or message ID without verifying that the resource belongs to the requesting account. Any authenticated user can therefore read another user's full AI chat history, modify individual message content, and delete or wipe entire conversations by enumerating sequential integer IDs.
Executive ViewAI
Blinko version 1.8.7 contains an access control vulnerability in its AI chat history endpoints that allows any authenticated user to read, modify, and delete conversations belonging to other users through sequential ID manipulation. This creates a significant data exposure risk, particularly for organizations using the platform to store sensitive business conversations or confidential information. Immediate upgrade to a patched version is critical to protect data confidentiality and compliance standing.
Apply vendor patch to version 1.8.8.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Blinko, an AI-powered card note-taking application, contains a path traversal vulnerability in its file server endpoint
A publicly accessible endpoint in Blinko prior to version 1.8.4 discloses sensitive user information including usernames
Blinko versions 1.8.3 and earlier contain a path traversal vulnerability in the plugin file server endpoint that fails t
Blinko versions prior to 1.8.4 contain a critical privilege escalation vulnerability in the upsertUser endpoint that all
Blinko versions prior to 1.8.4 allow authenticated high-privilege users to execute arbitrary commands through the MCP se
Cross-user private note disclosure in Blinko 1.8.7 allows any authenticated user to read other users' private notes, att
An Insecure Direct Object Reference (IDOR) vulnerability in Blinko versions prior to 1.8.4 allows authenticated attacker
Blinko versions 1.8.3 and earlier allow authenticated users to write arbitrary files to the filesystem through an unvali
Blinko, an AI-powered card note-taking application, contains an authenticated arbitrary file write vulnerability in the
Blinko, an AI-powered card note-taking application, contains a path traversal vulnerability in the filePath parameter th
Blinko, an AI-powered card note-taking application, contains an authentication bypass vulnerability in its comment manag
An insecure direct object reference (CWE-639) in Blinko through 1.8.8 lets any authenticated user read and modify tags b
Exploit-DB