CVE-2026-85624
🔶 mediumSummary
Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes including attachments and tags.
CVSS Score
6.5
Medium
EPSS Score
0.4
Exploit Probability
Published Date
2026-09-04
First Seen: 2026-09-05
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 46.8% of all 353,061 vulnerabilities in our database.
#187,990
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Sep 4, 2026
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
George Chen
SSVC data provided by
CISA
Last Modified
2026-09-04
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Vector 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)