CVE-2026-110774 Details

A broken access control vulnerability has been identified in Blinko versions through 1.8.8, specifically within the '/api/file' route. This vulnerability allows authenticated users to access other users' private attachments due to an inadequate owner verification process. Attackers can exploit this by providing a filename that follows a specific pattern, including a timestamp, to download private, non-shared files.

To address this vulnerability, the access control logic in the file-serving route should be revised to enforce ownership checks more effectively. This includes removing the current flaw that allows attachments with an 'accountId' to bypass owner verification, and instead implementing a positive ownership assertion that denies access unless the requester owns the attachment or the linked note.