CVE-2026-85624: Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList
Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes including attachments and tags.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to retrieve another user's private notes?
The attacker must be authenticated with a low-privilege account. No user interaction is required, and the vulnerable procedure can be exploited over the network.
What information can be exposed?
An attacker can retrieve the complete contents of other users' private notes, including attachments and tags, by supplying other users' note identifiers.
How can I determine whether my deployment is affected?
The affected version identified is Blinko 1.8.7. A deployment is exposed if authenticated users can call noteReferenceList and the procedure does not verify ownership of supplied note identifiers.