PT-2026-27214 · Blinko · Blinko

Tx1Ee · Published 2026-03-23 · Updated 2026-04-28 · CVE-2026-23486

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.4

Description A publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. The affected software is an AI-powered card note-taking project. The issue was addressed in version 1.8.4. The vulnerable endpoint is not explicitly named, but it allows unauthorized access to user data. The exposed data includes username, role, and account creation date.

Recommendations Update to version 1.8.4 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-23486

GHSA-446P-2XF5-FRXF

Affected Products

Blinko

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23486.json · Exploit
• https://github.com/blinkospace/blinko/commit/ec1e3e20384b620b8bf928fe80b4d8546757b419 · Patch
• https://github.com/blinkospace/blinko/security/advisories/GHSA-446p-2xf5-frxf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23486 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23486 · Vendor Advisory
• https://github.com/blinkospace/blinko/releases/tag/1.8.4 · Note
• https://twitter.com/pdnuclei_bot/status/2049051026578346094 · Twitter Post