Blinko 1.8.7 contains a cross‑user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes, including attachments and tags. This allows an attacker to read sensitive personal data that should remain confined to the note owner, violating confidentiality and privacy. The underlying weakness is an improper authorization flaw (CWE‑639) where access control checks are missing, enabling unauthorized data access.

The affected product is blinko provided by blinkospace, specifically version 1.8.7. No other versions are listed as affected, and the issue does not appear in later releases. Users running that version on any platform that hosts the server should be aware.

The CVSS score of 7.1 categorises the vulnerability as high severity, reflecting the potential for significant information disclosure. No EPSS data is available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting that no widespread exploitation has been observed yet. However, because the flaw requires only authentication, any legitimate user account could be abused to enumerate other users’ notes. The attack path involves an attacker with valid credentials sending requests to the noteReferenceList endpoint with fabricated note identifiers. Without patching or enforcing ownership checks, the attacker can recover any private note, its attachments, or tags belonging to other users.