CVE-2026-110774: Blinko through 1.8.8 Private Attachment Read via /api/file Route
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Blinko. The issue affects users who can obtain or predict another user's stored attachment filename.
What information does an attacker need to retrieve a private attachment?
The attacker needs the target attachment's stored filename. Filenames follow a basename plus millisecond-timestamp pattern, which can be supplied to the /api/file route.
Are only shared attachments exposed?
No. The affected route can be used to download private, non-shared attachments belonging to other users.
What is the impact of successful exploitation?
Successful exploitation exposes the contents of another user's private attachment. The provided severity vector indicates confidentiality impact only, with no stated integrity or availability impact.