Blinko Authorization Bypass via Insecure Direct Object Reference

Blinko version 1.8.7 contains an Insecure Direct Object Reference (IDOR) vulnerability within multiple tRPC procedures located in 'server/routerTrpc/message.ts' and 'server/routerTrpc/conversation.ts'. The affected procedures include message.list, message.update, message.delete, message.clearAfter, and conversation.clearMessages. While the application requires authentication to access these functions, the server fails to perform authorization checks to ensure the requested resource belongs to the authenticated user. By providing an arbitrary, enumerated conversation or message ID, an attacker can access the private AI chat history of any user on the system. This vulnerability enables unauthorized data exfiltration, the manipulation of sensitive conversation content, and the permanent destruction of user data through message or conversation deletion. Defenders should prioritize patching this vulnerability due to the potential for large-scale data compromise in multi-user Blinko environments.

Impact

Successful exploitation allows any authenticated user to read, modify, or delete the private AI chat history of other users. In a multi-user deployment, this leads to unauthorized information disclosure and loss of data integrity, with the risk of clearing entire chat databases through sequential ID enumeration.

Recommendation

Prioritize upgrading Blinko to the latest secure version addressing CVE-2026-85607. Monitor application-level logs for high-frequency tRPC request patterns where a single authenticated user session requests or deletes an abnormally high number of distinct conversation or message IDs within a short timeframe.