Executive brief
Blnk, an open-source financial ledger, contained a security flaw in how it manages API keys. An attacker with a standard API key could bypass security checks to create, list, or delete keys belonging to other users, or create new keys with higher privileges than they were originally granted. This could lead to unauthorized access to financial data or full control over the ledger system.
Technical details
An authorization bypass vulnerability (CWE-863) exists in Blnk's API key management flow. The application trusted caller-supplied request values when determining the 'owner' and 'scope' for key-management operations. A remote attacker authenticated with a non-master API key could manipulate these values to manage keys for different owners or perform privilege escalation by requesting broader scopes than their own key possessed. The fix, introduced in version 0.14.3, ensures the effective owner is derived directly from the authenticated session and enforces scope coverage checks.
Affected products
- blnkfinance Blnk <= 0.14.2
Timeline
- 2026-05-26: disclosed: Initial disclosure date
- 2026-06-26: advisory: GitHub Advisory published
- 2026-06-26: patched: Fix confirmed in version 0.14.3