CVE-2026-113597: Authorization Bypass Through User-Controlled Key in blinkospace blinko

CVE-2026-113597 describes an authorization bypass vulnerability in Blinko through version 1.8.8. The vulnerability exists in the tag tRPC router, where authenticated users can supply arbitrary tag IDs to access or modify tags belonging to other users. Functions such as fullTagNameById, updateTagIcon, and updateTagOrder can be abused to enumerate sequential tag IDs, revealing private note topics and allowing unauthorized modification of tag icons and order. The CVSS 4.0 base score is 5.3, indicating a medium severity issue with network attack vector, low attack complexity, and no user interaction required.

An attacker with authenticated access can read and modify tags of other users, potentially exposing private note topics and altering tag icons and their order. This compromises confidentiality and integrity of user data related to tags within the application.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions where possible and monitor for suspicious tag modification activity.