CVE-2026-23488: Blinko: multiple interfaces in the comment feature allow unauthorized access
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an unauthorized access vulnerability, allowing attackers to post comments on any note (including private notes) without authorization, even if the note has not been publicly shared. The /api/v1/comment/list endpoint has the same issue, allowing unauthorized viewing of comments on all notes. This issue has been patched in version 1.8.4.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23488?
The severity of CVE-2026-23488 is classified as a critical vulnerability due to its potential for unauthorized access to private notes.
How do I fix CVE-2026-23488?
To fix CVE-2026-23488, update Blinko to version 1.8.4 or later, which addresses the unauthorized access issue.
What are the consequences of exploiting CVE-2026-23488?
Exploiting CVE-2026-23488 allows attackers to post unauthorized comments on any note, including private notes, compromising user privacy.
Which versions of Blinko are affected by CVE-2026-23488?
All versions of Blinko prior to 1.8.4 are affected by CVE-2026-23488.
Is authentication necessary for the /api/v1/comment/create endpoint in CVE-2026-23488?
No, the /api/v1/comment/create endpoint lacks proper authentication, allowing unauthorized users to access it.