CVE-2026-110774 — Blinko through 1.8.8 Private Attachment Read via /api/file Route
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flaw…
Published: 2026-10-14 · CVSS: 6.0 · CVSS 4.0
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7