Blinko Information Exposure Vulnerability in Public User List Endpoint

A vulnerability in Blinko versions prior to 1.8.4 allows unauthorized access to sensitive user information through a public endpoint. The affected endpoint, '/v1/user/public-user-list', exposes usernames, roles, and account creation dates without requiring authentication. This information leak could facilitate user enumeration and identification of superadmin accounts.

Impact

The vulnerability could be exploited to gather sensitive user information, including roles and account creation dates, potentially leading to user enumeration and targeted attacks.

Remediation

Users can upgrade to Blinko version 1.8.4 or later to address this vulnerability.