CVE-2026-85607: Authorization Bypass Through User-Controlled Key in blinkospace blinko

CVE-2026-85607 is an authorization bypass (IDOR) vulnerability affecting Blinko up to version 1.8.8. The flaw exists in several tRPC procedures (message.list, message.update, message.delete, message.clearAfter, and conversation.clearMessages) where the server queries the database using caller-supplied conversation or message IDs without verifying ownership. Although authentication is required, the lack of proper authorization checks enables any authenticated user to enumerate sequential integer IDs to access, modify, or delete other users' AI chat history and conversations.

An attacker with valid authentication can read the full AI chat history of other users, modify individual messages, delete specific messages, or wipe entire conversations. This compromises user privacy and data integrity, potentially exposing sensitive information and allowing unauthorized data manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected tRPC procedures and implement additional authorization checks to verify resource ownership before processing requests.