CVE-2026-85624: Blinkospace Blinko

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes including attachments and tags.

Affected products

• Blinkospace Blinko: up to and including 1.8.8

Published 2026-09-04. Last modified 2026-09-10.