CVE-2026-23486

low-risk

Published 2026-03-23

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Blinko

Affected Vendors

Blinko

References (3)

Patch https://github.com/blinkospace/blinko/commit/ec1e3e20384b620b8bf928fe80b4d854675...

Release Notes https://github.com/blinkospace/blinko/releases/tag/1.8.4

Vendor Advisory https://github.com/blinkospace/blinko/security/advisories/GHSA-446p-2xf5-frxf

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal