CVE-2026-23487

6.0 mediumEPSS 0.2%

Medium (6.0) in blinko blinko. EPSS 0.2% chance of exploitation in the next 30 days.

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an IDOR vulnerability where user.detail Endpoint Leaks the Superadmin Token. This issue has been patched in version 1.8.4.

Severity

CVSS 4.0

6.0 medium

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-03-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

blinko:blinko

References

https://github.com/blinkospace/blinko/commit/bef6b770743e87c630db2d00d7049dabd96bfe85
https://github.com/blinkospace/blinko/releases/tag/1.8.4
https://github.com/blinkospace/blinko/security/advisories/GHSA-4ffv-78qx-9p66

Check your stack JSON