{"id":"CVE-2026-113597","kind":"vulnerability","aliases":["CVE-2026-113597"],"related":[],"title":"Blinko: tag API lets logged-in users read and edit other users' tags","description":"Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.","summary":"Blinko through 1.8.8 has an insecure direct object reference in its tag tRPC router, so any authenticated user can pass arbitrary tag IDs. An attacker can read private note topic names and change other users' tag icons and ordering.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["blinko","multi-user","package","self-hosted"],"not_affected_if":["no-registration","single-user"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T16:17:08+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:16:32+00:00","updated_at":"2026-10-25T04:16:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:16:32Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Blinko: tag API lets logged-in users read and edit other users' tags","impact":"low","summary":"Blinko through 1.8.8 has an insecure direct object reference in its tag tRPC router, so any authenticated user can pass arbitrary tag IDs. An attacker can read private note topic names and change other users' tag icons and ordering.","category":"package","nicknames":[],"who_cares":["blinko","self-hosted","multi-user"],"confidence":0.6,"needs_auth":"yes","worst_case":"Other users' private tag names read and tags modified","analyst_note":"Find the patched Blinko version and confirm whether the NVD entry or the project repo lists a fix; check how the tag routers scope queries by user ID.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["single-user","no-registration"],"who_is_affected":"Teams that run Blinko 1.8.8 or earlier as a shared multi-user instance, where more than one account can log in. A single-user deployment has no other users' tags to expose. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000548,"input_tokens":3353,"output_tokens":425,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113597':17A,20A '-2026':16A,19A '1.8.8':31B,70C 'allow':84C 'api':3A 'arbitrari':49B,96C 'attack':53B,99C 'authent':45B,85C 'blinko':1A,21B,29B,68C 'chang':61B 'contain':71C 'cve':15A,18A 'direct':35B,74C 'edit':11A 'enumer':101C 'fulltagnamebyid':105C 'host':28B 'icon':65B,118C 'id':51B,98C,103C 'insecur':34B,73C 'let':4A 'log':6A 'logged-in':5A 'modifi':90C 'multi':23B 'multi-us':22B 'name':59B 'note':57B,112C 'object':36B,75C 'order':67B,120C 'packag':25B 'pass':48B 'privat':56B,111C 'read':9A,55B,88C 'refer':37B,76C 'reveal':110C 'router':42B,82C 'self':27B 'self-host':26B 'sequenti':102C 'suppli':95C 'tag':2A,14A,40B,50B,64B,80C,93C,97C,117C 'tamper':115C 'topic':58B,113C 'trpc':41B,81C 'updatetagicon':106C 'updatetagord':108C 'user':8A,13A,24B,46B,63B,86C,92C 'via':104C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Blinko 1.8.8 or earlier as a shared multi-user instance, where more than one account can log in. A single-user deployment has no other users' tags to expose. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113597","severity":null,"published_at":"2026-10-20T16:17:08+00:00","modified_at":"2026-10-20T20:11:29+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}