CVE-2026-23486: Blinko: Unauthorized User Information Leak
Published Mar 23, 2026
·Updated
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4.
Affected Software
2 affected components
Blinko<1.8.4
Blinko Blinko<1.8.4
Remediation
Event History
Mar 23, 2026
CVE Published
via MITRE·08:42 PM
Data Sourced
via MITRE·08:42 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-23486?
CVE-2026-23486 is considered a high severity vulnerability due to the unauthorized exposure of sensitive user information.
2
How do I fix CVE-2026-23486?
To fix CVE-2026-23486, upgrade Blinko to version 1.8.4 or later.
3
What type of information is leaked in CVE-2026-23486?
CVE-2026-23486 exposes usernames, roles, and account creation dates of users.
4
Which versions of Blinko are affected by CVE-2026-23486?
Blinko versions prior to 1.8.4 are affected by CVE-2026-23486.
5
Is a workaround available for CVE-2026-23486?
There is no official workaround for CVE-2026-23486; users must upgrade to the patched version.