Is CVE-2026-110774 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110774?

CVE-2026-110774 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-110774

Description

Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.