CVE-2026-85624

Blinko 1.8.7 is vulnerable to a cross-user private note disclosure in the noteReferenceList procedure, which performs no ownership verification on supplied note identifiers. An authenticated attacker can enumerate sequential note IDs to retrieve the complete content of other users' private notes ...

CVE-2026-85607

Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts). Although these procedures require ...