Live › vulnerability › CVE-2026-113597
Go to dashboardBlinko through 1.8.8 has an insecure direct object reference in its tag tRPC router, so any authenticated user can pass arbitrary tag IDs. An attacker can read private note topic names and change other users' tag icons and ordering.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Blinko 1.8.8 or earlier as a shared multi-user instance, where more than one account can log in. A single-user deployment has no other users' tags to expose. The sources do not name a fixed version.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.
This page as .md · .json · in your agent: get_signal("CVE-2026-113597")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.