Blinko IDOR Vulnerability in User Detail Endpoint Allows Superadmin Token Leakage

An Insecure Direct Object Reference (IDOR) vulnerability has been identified in Blinko versions prior to 1.8.4. The issue arises in the user.detail endpoint, where the superadmin token is improperly exposed. This vulnerability allows any authenticated user to access the superadmin's permanent API token, leading to unauthorized escalation of privileges and the ability to perform all superadmin operations.

Impact

Exploitation of this vulnerability allows any authenticated user to obtain the superadmin's API token, facilitating an immediate escalation of privileges to superadmin status.

Remediation

Users can upgrade to Blinko version 1.8.4 or later to address this vulnerability.