Read the docs
TI-2026-85180 Aliases CVE-2026-122139GHSA-6v33-jwgx-fxf7

Account enumeration via password reset in blueprintUE Self-Hosted Edition

Priority LOW 30CWE-204Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-204.

Summary

blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration flaw in ForgotPasswordMiddleware.php. Unauthenticated remote attackers can compare password reset redirect targets for submitted emails to identify registered email addresses, since failed lookups are never rate-limited (CWE-204), enabling unlimited enumeration attempts.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.

Why it matters now

EPSS 0.00348 28th percentileScored 2026-11-07
Fix Fixed blueprintue-self-hosted-edition (blueprintue): 4.3.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
blueprintueblueprintue-self-hosted-editionbefore 4.3.34.3.3Patch availableCNA
  • blueprintue-self-hosted-edition Vendorblueprintue Affected before 4.3.3 Fixed in 4.3.3 Patch available CNA

Remediation

Update blueprintUE Self-Hosted Edition to version 4.3.3, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA blueprintue-self-hosted-edition (blueprintue) Fixed in 4.3.3

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122139
  2. 2026-11-04 Alias added: GHSA-6v33-jwgx-fxf7
  3. 2026-11-06 Priority changed: MEDIUM → LOW

References

Patch 2

Advisory 1

Other 2

  • TI-2026-29322 blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection CVSS 3.1HIGH 7.5
  • TI-2026-29324 blueprintUE: Authenticated Password Change Does Not Verify Current Password CVSS 3.1HIGH 8.1
  • TI-2026-29321 blueprintUE: Password Reset Tokens Have No Expiry Window CVSS 3.1HIGH 7.4
  • TI-2026-29323 blueprintUE: Active Sessions Are Not Invalidated After Password Change or Reset CVSS 3.1MEDIUM 6.5
  • TI-2026-85179 Login rate limit bypass in BlueprintUE Self-Hosted Edition CVSS 4.0MEDIUM 6.3
  • TI-2026-84856 Stale confirmation tokens activate accounts in blueprintUE Self-Hosted Edition CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences