{"id":"CVE-2026-121735","kind":"vulnerability","aliases":["CVE-2026-121735"],"related":[],"title":"blueprintUE: old account confirmation links still activate accounts","description":"blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.","summary":"blueprintUE self-hosted editions before 4.3.4 accept expired account confirmation tokens because the lookup ignores when the token was sent. An attacker holding an old confirmation link can activate an unconfirmed account and keep it from being cleaned up.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["blueprintue","other","self-hosted"],"not_affected_if":["managed-hosting","version-4.3.4-or-later"],"how_to_check":"- Check the installed blueprintUE self-hosted version and compare it with `4.3.4`","fix":"- blueprintUE self-hosted: `4.3.4` or later","status":"open","published_at":"2026-11-03T23:17:37+00:00","first_seen_at":"2026-11-03T23:45:15+00:00","triaged_at":"2026-11-03T23:45:45+00:00","updated_at":"2026-11-03T23:45:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-03T23:45:45Z","model":"claude-haiku-5-5","output":{"fix":"- blueprintUE self-hosted: `4.3.4` or later","reach":"internet","title":"blueprintUE: old account confirmation links still activate accounts","impact":"low","summary":"blueprintUE self-hosted editions before 4.3.4 accept expired account confirmation tokens because the lookup ignores when the token was sent. An attacker holding an old confirmation link can activate an unconfirmed account and keep it from being cleaned up.","audience":"businesses","category":"other","nicknames":[],"who_cares":["blueprintue","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unconfirmed accounts get activated using stale confirmation links","analyst_note":"","how_to_check":"- Check the installed blueprintUE self-hosted version and compare it with `4.3.4`\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["version-4.3.4-or-later","managed-hosting"],"who_is_affected":"Teams running the self-hosted blueprintUE edition before 4.3.4 with email account confirmation enabled. Attackers need an old confirmation link from a mailbox, backup or forwarded email. Hosted or newer installs are outside the stated range.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000662,"input_tokens":4249,"output_tokens":475,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121735':11A,14A '-2026':10A,13A '4.3.4':26B,65C 'accept':27B 'account':3A,8A,29B,52B,77C,106C,112C 'activ':7A,49B,104C 'allow':73C 'attack':42B,74C,88C 'backup':99C 'blueprintu':1A,15B,20B,59C 'clean':58B 'cleanup':113C 'compromis':97C 'confirm':4A,30B,46B,76C,85C,93C 'contain':66C 'cve':9A,12A 'edit':24B,63C 'evad':108C 'expir':28B,70C 'finduseridwithconfirmedtoken':83C 'forward':101C 'hold':43B 'host':19B,23B,62C 'ignor':35B,84C 'insuffici':68C 'job':114C 'keep':54B 'link':5A,47B,94C 'lookup':34B 'mail':102C 'mailbox':98C 'obtain':90C 'old':2A,45B,92C 'self':18B,22B,61C 'self-host':17B,21B,60C 'sent':40B,86C 'session':69C 'stale':79C 'still':6A 'token':31B,38B,80C 'unconfirm':51B,105C,111C 'unconfirmed-account':110C 'use':78C 'usermodel':82C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Teams running the self-hosted blueprintUE edition before 4.3.4 with email account confirmation enabled. Attackers need an old confirmation link from a mailbox, backup or forwarded email. Hosted or newer installs are outside the stated range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["blueprintue","medium","other","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T17:19:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121735","severity":null,"published_at":"2026-11-03T23:17:37+00:00","modified_at":"2026-11-03T23:17:37+00:00","first_seen_at":"2026-11-03T23:45:15+00:00","fetched_at":"2026-11-03T23:45:15+00:00","note":null}],"documents":[{"id":61688,"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/8bba1615bf76b144ac5cd72637c243490f08bc37","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61690,"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":61691,"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-qp6g-7v4v-33r9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T17:19:41+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":61692,"url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.4-non-expiring-account-confirmation-tokens","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}