CVE-2026-23487CWE-639

Blinko: IDOR - user.detail Endpoint Leaks Superadmin Token

Medium · published March 23, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
12.9
In the wild
Unconfirmed
What it is

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an IDOR vulnerability where user.detail Endpoint Leaks the Superadmin Token. This issue has been patched in version 1.8.4.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00228 · 12.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-23T20:45Z
EPSS history
Timeline
  • 23 MAR 20:45Z
    Blinko: IDOR - user.detail Endpoint Leaks Superadmin Token
    cvelistv5