CVE-2026-85624

6.5 Moyenne

Publiée le 04/09/2026 à 17:17 · Modifiée le 10/09/2026 à 17:53 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes including attachments and tags.

Traduire en français

Produits concernés

blinkospace blinko

Scores CVSS

Version	Score	Source	Vecteur
4.0	7.1 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	6.5 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-639

Références

https://github.com/blinkospace/blinko
https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/note.ts
https://github.com/blinkospace/blinko/issues/1217
https://www.vulncheck.com/advisories/blinko-1.8.7-cross-user-private-note-disclosure-via-notereferencelist
https://github.com/blinkospace/blinko/issues/1217

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories