The vulnerability resides in two API endpoints that lack proper access controls. An attacker can submit comments to any note or retrieve all comments, even when the notes are marked private. This grants the attacker ability to read and add content to notes that were intended to remain confidential, leading to information disclosure and potential integrity compromise.

Blinkospace Blinko, versions prior to 1.8.4. The application’s AI‑powered card note‑taking features are affected.

The CVSS score of 6.9 indicates a moderate severity. EPSS shows less than 1% likelihood of active exploitation, and it is not present in the CISA KEV list. The flaw can be leveraged remotely by any user who can reach the API endpoints; no prior authentication is required, so the attack surface is wide.