A public API endpoint in Blinko released information about every user, including usernames, roles and account creation dates. The disclosure represents a breach of confidentiality as it allows any visitor to gather user identities and privilege levels. The weakness matches CWE‑200, Unauthorized Access to Sensitive Information, and could enable attackers to build targeted social‑engineering or credential‑guessing campaigns.

The issue affects the Blinkospace Blinko application in all releases prior to 1.8.4. Users running the open‑source AI‑powered card note‑taking project are subject to the leak until the patch is applied. The patch was released in version 1.8.4, which removes the unauthenticated endpoint.

The CVSS score of 6.9 indicates a medium severity vulnerability. With an EPSS of 2 % the probability of exploitation is considered low and it is not currently listed in the CISA KEV catalog. Attackers can reach the vulnerable endpoint remotely via a simple HTTP GET request; no authentication or special privileges are required. Consequently, the vulnerability is exploitable by anyone with network access to the Blinko instance. While the impact is limited to information disclosure, the exposure of role data may assist further attacks.