CVE-2026-85624: Authorization Bypass Through User-Controlled Key in blinkospace blinko

CVE-2026-85624 is an authorization bypass vulnerability in Blinko version 1.8.7. The flaw exists because the noteReferenceList procedure does not verify ownership of note identifiers supplied by authenticated users. This allows an attacker with valid credentials to enumerate sequential note IDs and access private notes belonging to other users, including all associated content such as attachments and tags. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity, with network attack vector, low attack complexity, and no privileges required beyond authentication.

An authenticated attacker can access and disclose private notes of other users without authorization. This leads to exposure of sensitive information contained in notes, attachments, and tags. The vulnerability compromises confidentiality of user data within the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Until a patch is available, restrict access to trusted users and monitor for suspicious activity related to note enumeration.