Medium severity5.4NVD Advisory· Published Oct 20, 2026· Updated Oct 20, 2026
CVE-2026-113597
CVE-2026-113597
Description
Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=1.8.8
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.