Broken Access Control in Blinko Allows Unauthorized Access to Private Attachments
CVE-2026-110774

6MEDIUM

Key Information:

Vendor

Blinkospace

Status
Blinko
Vendor
CVE Published:
14 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-110774?

Blinko versions up to 1.8.8 are exposed to a broken access control vulnerability in the /api/file route. This flaw enables authenticated users to unjustly access private attachments belonging to other users. Through a flawed owner check, attackers can exploit this vulnerability by supplying the filename of another user's stored attachment, structured in a basename accompanied by a millisecond timestamp. This allows unauthorized downloads of confidential, non-shared attachments, posing significant privacy risks.

Affected Version(s)

blinko 0 <= 1.8.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-110774 - Proof of Concept

References

https://hackmd.io/@hieuPenguinnn/blinko-attachment-accoun...
technical-descriptionexploit
https://github.com/blinkospace/blinko/blob/178e4b3538a218...
technical-description
https://github.com/blinkospace/blinko
product

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.