Vulnerabilities
Report: CVE-2026-23488 - Blinko: multiple interfaces in the comment feature allow unauthorized access - Analysis
CVE ID :CVE-2026-23488 Published : March 23, 2026, 9:17 p.m. | 35 minutes ago Description :Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an unauthorized access vulnerability, allowing attackers to post comments on any note (including private notes) without authorization, even if the note has not been publicly shared. The /api/v1/comment/list endpoint has the same issue, allowing unauthorized viewing of comments on all notes. This issue has been patched in version 1.8.4. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...