CVE-2026-23480: Blinko: Low Privilege User Privilege Escalation - upsertUser Endpoint
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability. The upsertUser endpoint has 3 issues: it is missing superAdminAuthMiddleware, any logged-in user can call it; the originalPassword is an optional parameter and if not provided password verification is skipped; there is no check for input.id === ctx.id (ownership verification). This could result in any authenticated user modifying other users' passwords, direct escalation to superadmin, and complete account takeover. This issue has been patched in version 1.8.4.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23480?
CVE-2026-23480 is considered a low privilege user privilege escalation vulnerability.
How do I fix CVE-2026-23480?
To fix CVE-2026-23480, update your Blinko application to version 1.8.4 or later.
What specific endpoint is affected by CVE-2026-23480?
The upsertUser endpoint is affected by CVE-2026-23480.
Who is affected by CVE-2026-23480?
All versions of Blinko prior to version 1.8.4 are affected by CVE-2026-23480.
What issues are associated with the upsertUser endpoint in CVE-2026-23480?
The upsertUser endpoint is problematic as it lacks superAdminAuthMiddleware and allows any logged-in user to invoke it.