What’s Vulnerable › Vulnerabilities

CVE-2026-85624: Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-10
• Weakness: CWE-639

Description

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes including attachments and tags.

Affected products

• blinkospace blinko: through 1.8.8

References

• https://github.com/blinkospace/blinko
• https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/note.ts
• https://github.com/blinkospace/blinko/issues/1217
• https://www.vulncheck.com/advisories/blinko-1.8.7-cross-user-private-note-disclosure-via-notereferencelist
• https://github.com/blinkospace/blinko/issues/1217

Get alerted when CVE-2026-85624 or the next vulnerability affects your stack