The vulnerability is an IDOR in the user.detail endpoint of Blinko. An attacker who can reference another user’s identifier can obtain the superadmin token that grants full administrative authority over the application. With this token, the attacker could perform any privileged operation, such as modifying data, creating or deleting users, or managing system settings.

Blinko, an AI‑powered card note‑taking platform developed by BlinkoSpace, is affected. Any deployment running an installation of version 1.8.3 or earlier is vulnerable. The fix was released in version 1.8.4 and later versions are not impacted.

The CVSS score of 6.0 indicates a moderate severity. The EPSS score of less than 1% suggests that widespread exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit the flaw remotely by making an unauthenticated or insufficiently authenticated HTTP request to the user.detail API with a target user’s identifier, allowing the extraction of the superadmin token.