A high-severity authorization bypass vulnerability in Blinko allows any authenticated user to read, modify, or delete the AI chat history of other users.

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw within several tRPC procedures, including message list, update, delete, and conversation clear functions. Although these actions require authentication, the application fails to verify ownership of the requested conversation or message ID, enabling any authenticated user to manipulate data across the entire platform.

The ability for any authenticated user to access, alter, or destroy private AI chat history poses a severe risk to data confidentiality and integrity. Given the CVSS score of 8.8, this flaw could lead to significant privacy breaches and loss of sensitive information, potentially resulting in regulatory non-compliance and reputational damage for organizations utilizing Blinko for internal or customer-facing AI interactions.

Immediate Action: Update the Blinko installation to the latest available version that includes the security patch for these tRPC procedures. If an immediate update is not feasible, restrict access to the application to trusted users only.

Proactive Monitoring: Review database access logs and application audit trails for anomalous patterns, such as a single user account requesting a high volume of sequential message or conversation IDs.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to detect and block suspicious tRPC requests that target resource IDs outside of the expected scope for the authenticated user session.

Public Exploit Available: Unknown

The severity of this authorization bypass necessitates immediate attention from security teams. Because any authenticated user can compromise the entire dataset, the risk of data exposure is high. Administrators should prioritize patching the software to ensure that proper ownership checks are enforced on all backend procedures, effectively closing the IDOR vulnerability.