CVE-2026-23487: Blinko: IDOR - user.detail Endpoint Leaks Superadmin Token
Published Mar 23, 2026
·Updated
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an IDOR vulnerability where user.detail Endpoint Leaks the Superadmin Token. This issue has been patched in version 1.8.4.
Affected Software
2 affected components
Blinko Blinko<1.8.4
Blinko Blinko<1.8.4
Remediation
Event History
Mar 23, 2026
CVE Published
via MITRE·08:45 PM
Data Sourced
via MITRE·08:45 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-23487?
CVE-2026-23487 is considered a critical vulnerability due to the potential exposure of superadmin tokens.
2
How do I fix CVE-2026-23487?
To fix CVE-2026-23487, update Blinko to version 1.8.4 or later.
3
What kind of vulnerability is CVE-2026-23487?
CVE-2026-23487 is an Insecure Direct Object Reference (IDOR) vulnerability.
4
What does CVE-2026-23487 expose?
CVE-2026-23487 exposes sensitive superadmin tokens through the user.detail endpoint.
5
In which versions of Blinko is CVE-2026-23487 found?
CVE-2026-23487 is found in Blinko versions prior to 1.8.4.