/Vulnerability Library

Blinko <= 1.8.3 - User Information Leak

CVE-2026-23486
Verified

Description

Blinko <= 1.8.4 contains an information disclosure caused by a publicly accessible endpoint exposing user information including usernames, roles, and account creation dates, letting remote attackers access sensitive user data, exploit requires no special privileges.

Severity

Low

CVSS Score

5.3

Exploit Probability

1%

Affected Product

blinko

Published Date

April 28, 2026

Template Author

0x_akoko

CVE-2026-23486.yaml
5.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2026-23486
CWE ID:
cwe-200

References

https://github.com/blinkospace/blinko/security/advisories/GHSA-446p-2xf5-frxfhttps://github.com/blinkospace/blinkohttps://nvd.nist.gov/vuln/detail/CVE-2026-23486

Remediation Steps

Update to version 1.8.4 or later.