---
id: CVE-2026-113597
title: Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures
summary: >-
  Blinko through 1.8.8 contains an insecure direct object reference
  vulnerability in the tag tRPC router that allows authenticated users to read
  and modify other users' tags by supplying arbitrary tag IDs. Attackers can
  enumerate sequentia…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: blinkospace
product: blinko
affected:
  - blinko <= 1.8.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-20T16:40:12.152236Z'
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T16:40:26.591Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113597'
references:
  - url: 'https://github.com/blinkospace/blinko/issues/1112'
  - url: 'https://github.com/blinkospace/blinko/pull/1171'
  - url: 'https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/tag.ts'
  - url: >-
      https://www.vulncheck.com/advisories/blinko-through-1.8.8-idor-via-tag-trpc-router-procedures
    label: >-
      VulnCheck Advisory: Blinko through 1.8.8 IDOR via Tag tRPC Router
      Procedures
tags:
  - cve.org
ingestedAt: '2026-10-20T16:10:53.306Z'
---

## Overview

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.

## Affected

- `blinko <= 1.8.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.