Blinko <= 1.8.3 - User Information Leak

lowseverity

5.3CVSS score

0.7%likelihood of exploitation, next 30 days

55%of all CVEs are less likely

Readycheck to confirm it

Blinko <= 1.8.4 contains an information disclosure caused by a publicly accessible endpoint exposing user information including usernames, roles, and account creation dates, letting remote attackers access sensitive user data, exploit requires no special privileges.

Impact

Remote attackers can access sensitive user information, potentially leading to privacy violations and targeted attacks.

Fix

Update to version 1.8.4 or later.

How to confirm it

Send: GET {{BaseURL}}/
Positive when: status_code == 200 and contains_all(body, "<title>Blinko</title>", "Blinko self-hosted personal note")
Send: GET {{BaseURL}}/api/v1/user/public-user-list
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "\"name\":", "\"role\":")

Run it with nuclei: nuclei -id CVE-2026-23486 -u <target>

The full check

id: CVE-2026-23486

info:
  name: Blinko <= 1.8.3 - User Information Leak
  author: 0x_Akoko
  severity: low
  description: |
    Blinko <= 1.8.4 contains an information disclosure caused by a publicly accessible endpoint exposing user information including usernames, roles, and account creation dates, letting remote attackers access sensitive user data, exploit requires no special privileges.
  impact: |
    Remote attackers can access sensitive user information, potentially leading to privacy violations and targeted attacks.
  remediation: |
    Update to version 1.8.4 or later.
  reference:
    - https://github.com/blinkospace/blinko/security/advisories/GHSA-446p-2xf5-frxf
    - https://github.com/blinkospace/blinko
    - https://nvd.nist.gov/vuln/detail/CVE-2026-23486
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-200
    cve-id: CVE-2026-23486
    epss-score: 0.00727
    epss-percentile: 0.54493
  metadata:
    verified: true
    max-request: 1
    vendor: blinkospace
    product: blinko
    fofa-query: title="Blinko"
    shodan-query: http.title:"Blinko"
  tags: cve,cve2026,blinko,exposure,unauth

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "<title>Blinko</title>", "Blinko self-hosted personal note")'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/api/v1/user/public-user-list"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "\"name\":", "\"role\":")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from