Live › vulnerability › CVE-2026-121735
blueprintUE self-hosted editions before 4.3.4 accept expired account confirmation tokens because the lookup ignores when the token was sent. An attacker holding an old confirmation link can activate an unconfirmed account and keep it from being cleaned up.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Teams running the self-hosted blueprintUE edition before 4.3.4 with email account confirmation enabled. Attackers need an old confirmation link from a mailbox, backup or forwarded email. Hosted or newer installs are outside the stated range.
No product ranges from the sources yet.
4.3.44.3.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.
This page as .md · .json · in your agent: get_signal("CVE-2026-121735")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.