Description

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes including attachments and tags.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T15:17:42.737Z",
  "pubdate": "2026-09-04T15:17:42.737Z",
  "executiveSummary": "Blinko version 1.8.7 is susceptible to a cross-user private note disclosure vulnerability stemming from an Insecure Direct Object Reference (IDOR) flaw.\nThe vulnerability resides within the noteReferenceList procedure, which fails to implement mandatory ownership validation checks when processing note identifier requests.\nAn authenticated attacker can leverage this oversight to perform unauthorized data exfiltration by enumerating sequential note IDs.\nThe scope of the impact includes the full disclosure of private notes, including embedded attachments and associated metadata tags belonging to other users within the system.\nThis vulnerability poses a significant risk to data confidentiality, as it bypasses authorization controls and exposes sensitive user-generated content.\nThe attack requires a low barrier to entry, as the attacker only needs a valid authenticated session to initiate the enumeration process.\nNo administrative privileges are required, and the vulnerability can be exploited remotely by querying the application's API endpoints.",
  "technicalDetails": "The root cause of this vulnerability is the lack of server-side authorization logic within the noteReferenceList procedure. When a user requests a note via the system, the application processes the provided identifier without verifying that the requester holds appropriate ownership or access permissions for the requested resource.\nThe vulnerability is characterized as an Insecure Direct Object Reference (IDOR). By design, the noteReferenceList function is intended to fetch specific note data, but it fails to map the authenticated user context against the object owner field stored in the backend database.\nAn attacker can exploit this by conducting an automated enumeration attack. Since note identifiers follow a predictable or sequential pattern, an attacker can iterate through an incremental range of IDs. By crafting a series of requests to the noteReferenceList procedure using these incremented values, the application will return the object payload for any valid ID, regardless of who created the note.\nThe attack flow proceeds as follows: First, the attacker establishes a legitimate session by authenticating as a standard user. Second, the attacker monitors the network traffic to capture the request structure utilized by the noteReferenceList function. Third, the attacker scripts an iterative request pattern, modifying the note ID parameter in each sequential call. Finally, the server processes these requests without performing an access control check, responding with the complete data object, which includes the note's body content, attached binary data, and internal tags.\nThe vulnerability directly affects Blinko version 1.8.7. The impact of this exploit is comprehensive; unauthorized access allows for the batch scraping of the entire note database, leading to a complete breach of confidentiality for all users registered on the instance. Post-exploitation, an attacker gains visibility into sensitive user data, potentially leading to further compromise if private notes contain credentials or proprietary information."
}