CVE-2026-23480

High

Published: 23 March 2026

Published

23 March 2026

Modified

24 March 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 5.1th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-23480 is a high-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Blinko Blinko. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Other AI Platforms.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

AC-3 requires systems to enforce approved authorizations for access, directly addressing the missing superAdminAuthMiddleware and lack of ownership verification (input.id === ctx.id) in the upsertUser endpoint.

AC-6 Least Privilege good match

prevent

AC-6 enforces least privilege, preventing any authenticated user from escalating privileges to superadmin through unauthorized use of the upsertUser endpoint.

AC-2 Account Management good match

prevent

AC-2 requires approval and management processes for account modifications, mitigating unauthorized changes to other users' passwords and accounts via the upsertUser endpoint.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1098 Account Manipulation Persistence

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

attack.mitre.org →

Why these techniques?

Direct privilege escalation via missing auth/ownership checks on user management endpoint enables T1068; resulting unauthorized password/privilege changes map to T1098 Account Manipulation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability. The upsertUser endpoint has 3 issues: it is missing superAdminAuthMiddleware, any logged-in user can call it; the originalPassword is an optional parameter and…

if not provided password verification is skipped; there is no check for input.id === ctx.id (ownership verification). This could result in any authenticated user modifying other users' passwords, direct escalation to superadmin, and complete account takeover. This issue has been patched in version 1.8.4.

Deeper analysisAI

CVE-2026-23480 is a privilege escalation vulnerability (CWE-288) in Blinko, an AI-powered card note-taking project, affecting versions prior to 1.8.4. The issue resides in the upsertUser endpoint, which suffers from three key flaws: absence of superAdminAuthMiddleware, allowing any logged-in user to invoke it; an optional originalPassword parameter that skips password verification if not supplied; and lack of ownership verification via input.id === ctx.id check. These deficiencies enable unauthorized user data manipulation.

An attacker with any valid user account can exploit this remotely (AV:N) with low attack complexity (AC:L), no user interaction (UI:N), and low privileges (PR:L), earning a CVSS v3.1 base score of 8.8 (C:H/I:H/A:H). Successful exploitation allows modification of other users' passwords, direct privilege escalation to superadmin, and full account takeover, potentially compromising the entire user base.

The vulnerability was addressed in Blinko version 1.8.4. Mitigation details are available in the GitHub security advisory (GHSA-r3mv-q7ww-86p6), release notes (github.com/blinkospace/blinko/releases/tag/1.8.4), and the patching commit (github.com/blinkospace/blinko/commit/3afbdf486b6f371bdac5781dea6289749f2c4c03). Practitioners should upgrade immediately and audit similar endpoints for middleware, verification, and ownership controls.