blinkospace CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM blinkospace CVE published 2026-10-14

CVE-2026-110774

CVE-2026-110774 is a broken access control vulnerability in Blinko versions up to 1.8.8 that allows authenticated users to read private attachments of other users via the /api/file route. The vulnerability arises from a flawed owner check, enabling attackers to supply another user's stored filename and download their private, non-shared attachments.