CVE-2026-85607 Details
Description
Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts). Although these procedures require authentication, they query the database by caller-supplied conversation or message ID without verifying that the resource belongs to the requesting account. Any authenticated user can therefore read another user's full AI chat history, modify individual message content, and delete or wipe entire conversations by enumerating sequential integer IDs.
A vulnerability in Blinko version 1.8.7 allows for authorization bypass through an Insecure Direct Object Reference (IDOR) in several tRPC procedures. The affected procedures are 'message.list', 'message.update', 'message.delete', 'message.clearAfter' in 'server/routerTrpc/message.ts', and 'conversation.clearMessages' in 'server/routerTrpc/conversation.ts'. Although these procedures require authentication, they fail to verify ownership of the resources being accessed or modified. This allows any authenticated user to read another user's entire AI chat history, alter individual messages, and delete or clear entire conversations by manipulating sequential integer IDs.
Users are advised to update to Blinko version 1.8.8, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/blinkospace/blinko/issues/1218 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/blinkospace/blinko | [email protected] | ProductVendor |
| https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/conversation.ts | [email protected] | Source CodeVendor |
| https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/message.ts | [email protected] | Source CodeVendor |
| https://github.com/blinkospace/blinko/issues/1218 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/blinko-1.8.7-cross-user-ai-conversation-read-and-write-via-message-trpc-router | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Blinko | <= 1.8.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |