CVE-2026-85624: Blinko Information Disclosure Vulnerability

CVE-2026-85624 Overview

CVE-2026-85624 is an authorization bypass vulnerability in Blinko 1.8.7, an open-source personal note-taking application. The flaw resides in the noteReferenceList procedure within the tRPC note router, which fails to verify note ownership before returning content. Any authenticated user can enumerate sequential note identifiers and retrieve private notes belonging to other users, including attachments and tags. The issue is classified as an Insecure Direct Object Reference [CWE-639] and requires only low-privilege authentication to exploit over the network.

Critical Impact
Authenticated users can read arbitrary private notes across all Blinko tenants by iterating note IDs, breaking the confidentiality boundary between accounts.

Affected Products

Blinko 1.8.7
Deployments exposing the noteReferenceList tRPC procedure
Multi-user Blinko instances where tenant isolation is required

Discovery Timeline

2026-09-04 - CVE-2026-85624 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85624

Vulnerability Analysis

Blinko exposes a tRPC procedure named noteReferenceList that returns note content when supplied with a note identifier. The handler in server/routerTrpc/note.ts accepts the client-supplied ID and queries the underlying data store without filtering by the requesting user's account. As a result, ownership is never enforced at the procedure boundary.

Because Blinko assigns note identifiers sequentially, an authenticated attacker can iterate integer IDs starting from 1 and receive the full body of every referenced note. Returned payloads include private note contents, associated attachments, and tag metadata. The vulnerability breaks tenant separation across the entire application even though users authenticate with distinct accounts.

Root Cause

The root cause is a missing authorization check on a data-access procedure, mapped to [CWE-639] Authorization Bypass Through User-Controlled Key. The noteReferenceList procedure trusts the ID parameter without joining ownership to the caller's session context. See the GitHub Blinko Note Handler Code and GitHub Blinko Issue #1217 for the specific handler and disclosure.

Attack Vector

Exploitation requires a valid low-privilege Blinko account and network access to the tRPC endpoint. An attacker registers or uses an existing account, obtains a session token, and then issues repeated noteReferenceList calls against sequential integer IDs. No user interaction on the victim side is needed. Refer to the VulnCheck Advisory for Blinko 1.8.7 for the full technical write-up.

Detection Methods for CVE-2026-85624

Indicators of Compromise

Repeated noteReferenceList tRPC calls from a single session against monotonically increasing note IDs.
Authenticated sessions retrieving note payloads at a rate inconsistent with normal user behavior.
Application logs showing note reads where the retrieved note's owner differs from the requesting account.

Detection Strategies

Instrument the noteReferenceList handler to log the requesting user ID alongside the returned note's owner and alert on mismatches.
Baseline typical note-read volumes per session and flag sessions exceeding the baseline by an order of magnitude.
Correlate authentication events with subsequent enumeration patterns in reverse proxy or web application firewall (WAF) logs.

Monitoring Recommendations

Forward Blinko application and reverse proxy logs to a centralized SIEM for retention and analytic queries.
Track distinct note IDs accessed per authenticated user over rolling time windows.
Alert on newly created accounts that immediately begin large-scale note-reference queries.

How to Mitigate CVE-2026-85624

Immediate Actions Required

Upgrade Blinko from 1.8.7 to a fixed release; consult the GitHub Blinko Repository for the latest tagged version and release notes.
Restrict access to Blinko instances behind authenticated reverse proxies or VPNs until patched.
Rotate session tokens and audit account inventories to identify unfamiliar or dormant accounts that could be misused for enumeration.

Patch Information

The vulnerable code path resides in server/routerTrpc/note.ts at tag 1.8.8, referenced in GitHub Blinko Issue #1217. Administrators should track the upstream repository for a release that adds ownership validation to noteReferenceList and any related procedures.

Workarounds

Disable public registration on Blinko instances to limit who can obtain the authenticated context required for exploitation.
Place the application behind a WAF rule that rate-limits noteReferenceList calls per session and blocks sequential ID enumeration patterns.
Segment sensitive Blinko deployments from general user populations until the ownership check is added.

bash

# Example nginx rate limit to slow enumeration against the tRPC endpoint
limit_req_zone $binary_remote_addr zone=blinko_trpc:10m rate=10r/m;

server {
    location /api/trpc/notes.noteReferenceList {
        limit_req zone=blinko_trpc burst=5 nodelay;
        proxy_pass http://blinko_upstream;
    }
}