---
id: "CVE-2026-121735"
kind: "vulnerability"
aliases: ["CVE-2026-121735"]
title: "blueprintUE: old account confirmation links still activate accounts"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["blueprintue", "other", "self-hosted"]
not_affected_if: ["managed-hosting", "version-4.3.4-or-later"]
published_at: "2026-11-03T23:17:37+00:00"
first_seen_at: "2026-11-03T23:45:15+00:00"
updated_at: "2026-11-03T23:45:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121735", "first_seen_at": "2026-11-03T23:45:15+00:00"}]
---

# blueprintUE: old account confirmation links still activate accounts

blueprintUE self-hosted editions before 4.3.4 accept expired account confirmation tokens because the lookup ignores when the token was sent. An attacker holding an old confirmation link can activate an unconfirmed account and keep it from being cleaned up.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed blueprintUE self-hosted version and compare it with `4.3.4`

## Fix

- blueprintUE self-hosted: `4.3.4` or later

## Timeline

- 2026-11-03T23:45:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121735

## Documents

- [advisory] Vendor advisory: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-qp6g-7v4v-33r9
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.4-non-expiring-account-confirmation-tokens
- [fix] Patch: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/8bba1615bf76b144ac5cd72637c243490f08bc37
- [fix] Release notes: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4

## From the sources

blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_