CVE-2026-110774Published
Blinko through 1.8.8 Private Attachment Read via /api/file Route
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-110774 · Microsoft / collected KEV context
cve-program · CVE-2026-110774
- https://hackmd.io/@hieuPenguinnn/blinko-attachment-accountid-idor
- https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/server/routerExpress/file/file.ts#L148
- https://github.com/blinkospace/blinko
- https://www.vulncheck.com/advisories/blinko-through-1.8.8-private-attachment-read-via-api-file-route
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.