CVE-2026-122139 · Vendor
NO FIX YET · SEE WHAT TO DO
blueprintUE Self-Hosted Edition before 4.3.3 leaks whether an email address has an account through its password reset flow, and failed lookups are not rate-limited. An unauthenticated attacker can test unlimited email addresses to build a list of registered users.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organisations running blueprintUE Self-Hosted Edition before version 4.3.3 with the password reset feature exposed. Hosted or managed blueprintUE instances are outside the scope of this entry, and the sources do not say whether managed deployments are affected.
Not affected if managed-hosting, version-4.3.3-or-later
Who cares blueprintue, password-reset, self-hosted
4.3.3ForgotPasswordMiddleware.php in the installation for the redirect behaviour described in the advisory4.3.3 or laterblueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.