Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures. An authenticated user can read another user’s full AI chat history, modify individual message content, or delete or wipe entire conversations by supplying arbitrary conversation or message identifiers. The weakness is classified as CWE‑639, representing an authorization bypass through user‑controlled keys.

Blinko, developed by blinkospace, is affected only in version 1.8.7. Version 1.8.8 and later incorporate the fix that enforces ownership validation for all impacted tRPC routes.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, but based on the description, it is inferred that exploitation is straightforward because the flaw requires only an authenticated session and the enumeration of numeric IDs, which are sequential. The attack vector is likely simple ID enumeration without external dependencies. Although the vulnerability is not listed in CISA’s KEV catalog, its straightforward nature and lack of authorization checks suggest that it could be actively abused once discovered.