Blinko versions through 1.8.8 contain a broken access control flaw in the /api/file endpoint that lets a logged‑in user retrieve private attachments belonging to other users. The route performs a flawed ownership check, allowing an attacker to supply the filename of another user’s attachment, which follows a predictable basename plus millisecond‑timestamp format, and download the file. The vulnerability enables disclosure of non‑shared content but does not grant execution or escalation of privileges. It stems from the CWE-639 weakness of authorisation bypass via user‑controlled keys.

The affected product is Blinko from blinkospace. Versions 1.8.8 and earlier are vulnerable. No specific patch version is listed, but the issue is known to exist up to 1.8.8.

The CVSS score of 6.0 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not actively exploited at this time. The attack requires that the attacker be authenticated and have knowledge or guess of the target user’s attachment filename, implying a limited but non‑trivial exploitation window. If an attacker knows a valid filename, the resource can be read directly via a crafted HTTP GET request to /api/file.