Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-113597Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in blinko from blinkospace. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 80.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.

Affected products (as reported)

Vendor	Product	Versions
blinkospace	blinko	0 – through 1.8.8

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/blinkospace/blinko/issues/1112 issue-tracking
https://github.com/blinkospace/blinko/pull/1171 patch, issue-tracking
https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/tag.ts technical-description
VulnCheck Advisory: Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures third-party-advisory