PT-2026-27216 · Blinko · Blinko

Tx1Ee · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-23488

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.4

Description Blinko, an AI-powered card note-taking project, contains an issue where the comment feature allows unauthorized access. Specifically, the /api/v1/comment/create endpoint permits attackers to post comments on any note, including private ones, without proper authorization. The /api/v1/comment/list endpoint also suffers from this problem, allowing unauthorized viewing of comments on all notes. The vulnerable parameters are not specified.

Recommendations Update to version 1.8.4 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-23488

GHSA-84HM-VW62-472M

Affected Products

Blinko

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23488.json · Exploit
• https://github.com/blinkospace/blinko/security/advisories/GHSA-84hm-vw62-472m · Vendor Advisory
• https://github.com/blinkospace/blinko/commit/4623dd02bdeed768ffa6fea4cc2f8644cbb08c5e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23488 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23488 · Vendor Advisory
• https://github.com/blinkospace/blinko/pull/1089 · Note
• https://github.com/blinkospace/blinko/releases/tag/1.8.4 · Note
• https://twitter.com/cyberbivash/status/2036206848999580148 · Twitter Post