CyberRota Analysis
AI-GeneratedBlinko 1.8.7 is vulnerable to an authorization bypass due to improper validation of user-supplied conversation and message IDs in several tRPC procedures, allowing authenticated users to access, modify, or delete other users' chat histories. This high-severity vulnerability poses a significant risk to user privacy and data integrity. Organizations using this version of Blinko should prioritize immediate remediation to protect sensitive user information from unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts). Although these procedures require authentication, they query the database by caller-supplied conversation or message ID without verifying that the resource belongs to the requesting account. Any authenticated user can therefore read another user's full AI chat history, modify individual message content, and delete or wipe entire conversations by enumerating sequential integer IDs.