Privilege Escalation Vulnerability in Blinko by Blinkospace

CVE-2026-23480

What is CVE-2026-23480?

Blinko, an AI-driven card note-taking tool, exhibits a privilege escalation vulnerability before version 1.8.4. The upsertUser endpoint is vulnerable due to three significant issues: the absence of superAdminAuthMiddleware allows any logged-in user to access it; originalPassword, an optional parameter, can bypass password verification if omitted; and a lack of ownership verification (input.id === ctx.id) enables any authenticated user to alter the passwords of other users. These vulnerabilities pose a serious risk, including the potential for any authenticated user to escalate privileges to superadmin status, leading to comprehensive account takeover. The issues have been addressed in version 1.8.4.

References