CVE-2026-23487

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an IDOR vulnerability where user.detail Endpoint Leaks the Superadmin Token. This issue has been patched in version 1.8.4.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - security-advisories@github.com

Published

2026-03-23

Last modified

2026-03-24

Weaknesses

CWE-639

Affected products

• Blinko (Blinko)
• Blinko (Blinkospace)

References

• https://github.com/blinkospace/blinko/commit/bef6b770743e87c630db2d00d7049dabd96bfe85
• https://github.com/blinkospace/blinko/releases/tag/1.8.4
• https://github.com/blinkospace/blinko/security/advisories/GHSA-4ffv-78qx-9p66