Vulnerability Description
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an unauthorized access vulnerability, allowing attackers to post comments on any note (including private notes) without authorization, even if the note has not been publicly shared. The /api/v1/comment/list endpoint has the same issue, allowing unauthorized viewing of comments on all notes. This issue has been patched in version 1.8.4.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Blinko | Blinko | < 1.8.4 |
Related Weaknesses (CWE)
References
- https://github.com/blinkospace/blinko/commit/4623dd02bdeed768ffa6fea4cc2f8644cbbPatch
- https://github.com/blinkospace/blinko/pull/1089Release Notes
- https://github.com/blinkospace/blinko/releases/tag/1.8.4Release Notes
- https://github.com/blinkospace/blinko/security/advisories/GHSA-84hm-vw62-472mVendor Advisory
FAQ
What is CVE-2026-23488?
CVE-2026-23488 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an unauthorized access vulnerability, allowing attackers to post comments on any note ...
How severe is CVE-2026-23488?
CVE-2026-23488 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-23488?
Check the references section above for vendor advisories and patch information. Affected products include: Blinko Blinko.