A privilege escalation flaw exists in the upsertUser endpoint of Blinko, an AI‑driven card note‑taking system. The endpoint is missing a superAdminAuthMiddleware, accepts an optional originalPassword field that bypasses verification when omitted, and fails to verify that the target user ID matches the caller’s own ID. These oversights allow any authenticated user to change another user's password, elevate privileges to a superadmin level, and ultimately take full control of that account.

The vulnerability affects the blinkospace Blinko application. All versions before 1.8.4 are vulnerable. The patch is available in release 1.8.4 as referenced in the official advisory.

The CVSS score is 5.3, indicating medium severity, and the EPSS score is below 1%, suggesting a low probability of exploitation. It is not listed in the CISA KEV catalog. Attackers must be authenticated to the application and can exploit the unguarded upsertUser endpoint locally; thus the likely attack vector is an internal, authenticated user path.