CVE-2026-110774
Blinko through 1.8.8 Private Attachment Read via /api/file Route
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.
| CWE | CWE-639 |
| Vendor | blinkospace |
| Product | blinko |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for blinkospace blinko
Be the first to know when new medium vulnerabilities affecting blinkospace blinko are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
blinkospace / blinko
0 ≤ 1.8.8
References
hackmd.io: https://hackmd.io/@hieuPenguinnn/blinko-attachment-accountid-idor github.com: https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/server/routerExpress/file/file.ts#L148 github.com: https://github.com/blinkospace/blinko vulncheck.com: https://www.vulncheck.com/advisories/blinko-through-1.8.8-private-attachment-read-via-api-file-route
Credits
hieuPenguinnn