CVE-2026-23486 MEDIUM

CVE-2026-23486: Blinko: Unauthorized User Information Leak

Vendor Blinkospace

Product blinko

Weakness CWE-200 · Info exposure

Published March 23, 2026

Last update March 24, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4.

Key dates

02Disclosure timeline

March 23, 2026 CVE published

March 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-23486 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html

Related vulnerabilities

04Related CVE

CVE-2024-24817 User can see invitees in events created in PMs and private categories CVE-2026-32618 Discourse: Unauthorized channel membership inference via excluded_memberships_channel_id CVE-2018-10859 CVE-2025-12468 FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure CVE-2023-33960 OpenProject vulnerable to project identifier information leakage through robots.txt