Insecure Direct Object Reference in Blinko Affects User Tag Management
CVE-2026-113597

5.3MEDIUM

Key Information:

Vendor

Blinkospace

Status
Blinko
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113597?

Blinko versions prior to 1.8.8 contain an insecure direct object reference vulnerability in the tag tRPC router. This allows authenticated users to access and alter the tags of other users by providing arbitrary tag IDs. Attackers can exploit this issue to sequentially enumerate tag IDs using specific functions like fullTagNameById, updateTagIcon, and updateTagOrder. This can lead to unauthorized disclosure of private note topics and manipulation of tag icons and their order, posing significant risks to user privacy and data integrity.

Affected Version(s)

blinko 0 <= 1.8.8

References

https://github.com/blinkospace/blinko/issues/1112
issue-tracking
https://github.com/blinkospace/blinko/pull/1171
patchissue-tracking
https://github.com/blinkospace/blinko/blob/1.8.8/server/r...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.