CVE-2026-113597

CVSS 5.4 (medium) · published 2026-10-20

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.

Weakness: CWE-639

Source: NVD CVE-2026-113597

References

• https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/tag.ts
• https://github.com/blinkospace/blinko/issues/1112
• https://github.com/blinkospace/blinko/pull/1171
• https://www.vulncheck.com/advisories/blinko-through-1.8.8-idor-via-tag-trpc-router-procedures

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.