CVE-2026-122139mediumCWE-204

CVE-2026-122139: medium-severity vulnerability in blueprintue-self-hosted-edition

blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset

Published

Follow this CVE+ Monitor blueprintue-self-hosted-edition

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.3%
blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
blueprintue · blueprintue-self-hosted-edition
Related CVEs — blueprintue-self-hosted-edition

In the same product, most dangerous first.

CVE-2026-40586HIGHblueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force ProtectionEPSS 0.4%CVE-2026-122138MEDIUMBlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit BypassEPSS 0.3%CVE-2026-40588HIGHblueprintUE: Authenticated Password Change Does Not Verify Current PasswordEPSS 0.3%CVE-2026-40585HIGHblueprintUE: Password Reset Tokens Have No Expiry WindowEPSS 0.3%CVE-2026-40587MEDIUMblueprintUE: Active Sessions Are Not Invalidated After Password Change or ResetEPSS 0.2%CVE-2026-121735MEDIUMblueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation TokensEPSS 0.2%