CVE-2026-113597

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.

CVSS 4.0

5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-25)

CWE

CWE-639

Published

2026-10-20

Modified

2026-10-20

Record from

the NVD, synced 2026-10-21

References

• https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/tag.ts
• https://github.com/blinkospace/blinko/issues/1112
• https://github.com/blinkospace/blinko/pull/1171
• https://www.vulncheck.com/advisories/blinko-through-1.8.8-idor-via-tag-trpc-router-procedures

Check your stackJSON