Read the docs
TI-2026-84856 Aliases CVE-2026-121735GHSA-pc87-6hr3-m9jr

Stale confirmation tokens activate accounts in blueprintUE Self-Hosted Edition

Priority LOW 28CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

blueprintUE Self-Hosted Edition before 4.3.4 has an insufficient session expiration flaw, CWE-613. The confirmation check does not compare the token's sent time, so old confirmation tokens still activate accounts. An attacker who gets an old confirmation link from a compromised mailbox, backup or forwarded mail can activate an unconfirmed account and avoid the unconfirmed-account cleanup job. The CVSS 4.0 vector shows network access with no privileges or user interaction, and the impact is limited to integrity.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.

Why it matters now

EPSS 0.0023 13th percentileScored 2026-11-07
Fix Fixed blueprintue-self-hosted-edition (blueprintue): 4.3.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
blueprintueblueprintue-self-hosted-editionbefore 4.3.44.3.4Patch availableCNA
  • blueprintue-self-hosted-edition Vendorblueprintue Affected before 4.3.4 Fixed in 4.3.4 Patch available CNA

Remediation

Upgrade blueprintUE Self-Hosted Edition to version 4.3.4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA blueprintue-self-hosted-edition (blueprintue) Fixed in 4.3.4

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121735
  2. 2026-11-04 Alias added: GHSA-pc87-6hr3-m9jr
  3. 2026-11-05 Priority changed: MEDIUM → LOW

References

Patch 2

Advisory 1

Other 3

  • TI-2026-29322 blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection CVSS 3.1HIGH 7.5
  • TI-2026-29324 blueprintUE: Authenticated Password Change Does Not Verify Current Password CVSS 3.1HIGH 8.1
  • TI-2026-29321 blueprintUE: Password Reset Tokens Have No Expiry Window CVSS 3.1HIGH 7.4
  • TI-2026-29323 blueprintUE: Active Sessions Are Not Invalidated After Password Change or Reset CVSS 3.1MEDIUM 6.5
  • TI-2026-85180 Account enumeration via password reset in blueprintUE Self-Hosted Edition CVSS 4.0MEDIUM 6.9
  • TI-2026-85179 Login rate limit bypass in BlueprintUE Self-Hosted Edition CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences