PT-2026-27214 · Blinko · Blinko

Tx1Ee · Publicado 2026-03-23 · Atualizado 2026-04-28 · CVE-2026-23486

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.4

Description A publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. The affected software is an AI-powered card note-taking project. The issue was addressed in version 1.8.4. The vulnerable endpoint is not explicitly named, but it allows unauthorized access to user data. The exposed data includes username, role, and account creation date.

Recommendations Update to version 1.8.4 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-23486

GHSA-446P-2XF5-FRXF

Produtos afetados

Blinko

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23486.json · Exploit
• https://github.com/blinkospace/blinko/commit/ec1e3e20384b620b8bf928fe80b4d8546757b419 · Correção
• https://github.com/blinkospace/blinko/security/advisories/GHSA-446p-2xf5-frxf · Aviso do Fabricante
• https://github.com/blinkospace/blinko/releases/tag/1.8.4 · Nota
• https://twitter.com/pdnuclei_bot/status/2049051026578346094 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23486 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-23486 · Nota de Segurança