CVE-2026-23486 Blinko: Unauthorized User Information Leak
An attacker can access a public endpoint to view all user information, including usernames and roles, in the Blinko application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-23486?
CVE-2026-23486 is a medium-severity vulnerability in blinkospace blinko, published on 23 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4.
Weakness: CWE-200
Which versions are affected by CVE-2026-23486?
It affects 1 product.
Products include Blinko Blinko.
How do I fix CVE-2026-23486?
No fix has been published for CVE-2026-23486 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-23486 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-23486 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in blinkospace blinko
- CVE-2026-23882 Blinko: Admin RCE - MCP Server Command Injection
- CVE-2026-23482 Blinko: Unauthorized Arbitrary File Read - /api/file/temp
- CVE-2026-23483 Blinko: Unauthorized Arbitrary File Read - /plugins
- CVE-2026-23485 Blinko: Unauthorized Path Traversal File Enumeration - music-metadata
- CVE-2026-23488 Blinko: multiple interfaces in the comment feature allow unauthorized access
Sources
Also known as GHSA-446p-2xf5-frxf.