Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck
CVE-2026-85624Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in blinko from blinkospace. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 63.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes including attachments and tags.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| blinkospace | blinko | 0 – through 1.8.8 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Issue #1217 issue-tracking
- https://github.com/blinkospace/blinko product
- https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/note.ts technical-description
- VulnCheck Advisory: Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList third-party-advisory