---
id: "CVE-2026-113597"
kind: "vulnerability"
aliases: ["CVE-2026-113597"]
title: "Blinko: tag API lets logged-in users read and edit other users' tags"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["blinko", "multi-user", "package", "self-hosted"]
not_affected_if: ["no-registration", "single-user"]
published_at: "2026-10-20T16:17:08+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:16:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113597", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Blinko: tag API lets logged-in users read and edit other users' tags

Blinko through 1.8.8 has an insecure direct object reference in its tag tRPC router, so any authenticated user can pass arbitrary tag IDs. An attacker can read private note topic names and change other users' tag icons and ordering.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113597

## From the sources

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_