CVE-2026-85624

Blinko 1.8.7 is vulnerable to an authorization bypass (CWE-639) in its noteReferenceList procedure, which accepts note identifiers without verifying that the requesting user owns them. An authenticated attacker triggers the flaw by supplying note IDs belonging to other users and can enumerate the sequential IDs to systematically pull records. The attacker gains read access to the complete content of other users' private notes, including attachments and tags, with no confidentiality impact beyond data disclosure (CVSS 4.0 7.1, high). Any Blinko 1.8.7 deployment with multiple user accounts is affected; single-user self-hosted instances have minimal exposure. No public proof-of-concept, KEV listing, or known exploitation exists, and EPSS puts 30-day exploitation probability at just 0.4%.

What to do: Upgrade Blinko to the first release published after 1.8.7 that adds ownership verification in noteReferenceList as soon as it is available. Until patched, limit the number of user accounts per instance and avoid hosting untrusted users on the same deployment. Check application/API logs for authenticated accounts requesting sequential or foreign note IDs, which would indicate enumeration attempts.