{"id":"CVE-2026-122139","kind":"vulnerability","aliases":["CVE-2026-122139"],"related":[],"title":"blueprintUE Self-Hosted: password reset reveals which email addresses are registered","description":"blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.","summary":"blueprintUE Self-Hosted Edition before 4.3.3 leaks whether an email address has an account through its password reset flow, and failed lookups are not rate-limited. An unauthenticated attacker can test unlimited email addresses to build a list of registered users.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["blueprintue","password-reset","self-hosted","vendor"],"not_affected_if":["managed-hosting","version-4.3.3-or-later"],"how_to_check":"- Check the installed blueprintUE Self-Hosted version and confirm whether it is below `4.3.3`\n- Review `ForgotPasswordMiddleware.php` in the installation for the redirect behaviour described in the advisory","fix":"- blueprintUE Self-Hosted Edition: `4.3.3` or later","status":"open","published_at":"2026-11-04T21:18:10+00:00","first_seen_at":"2026-11-04T21:49:20+00:00","triaged_at":"2026-11-04T21:51:03+00:00","updated_at":"2026-11-04T21:51:03+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-04T21:51:03Z","model":"claude-haiku-5-5","output":{"fix":"- blueprintUE Self-Hosted Edition: `4.3.3` or later","reach":"internet","title":"blueprintUE Self-Hosted: password reset reveals which email addresses are registered","impact":"low","summary":"blueprintUE Self-Hosted Edition before 4.3.3 leaks whether an email address has an account through its password reset flow, and failed lookups are not rate-limited. An unauthenticated attacker can test unlimited email addresses to build a list of registered users.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["blueprintue","self-hosted","password-reset"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker builds a list of registered user email addresses","analyst_note":"","how_to_check":"- Check the installed blueprintUE Self-Hosted version and confirm whether it is below `4.3.3`\n- Review `ForgotPasswordMiddleware.php` in the installation for the redirect behaviour described in the advisory","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","version-4.3.3-or-later"],"who_is_affected":"Organisations running blueprintUE Self-Hosted Edition before version 4.3.3 with the password reset feature exposed. Hosted or managed blueprintUE instances are outside the scope of this entry, and the sources do not say whether managed deployments are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4219,"output_tokens":536,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122139':15A,18A '-2026':14A,17A '4.3.3':33B,76C 'account':41B,79C 'address':10A,38B,62B,92C 'allow':85C 'attack':57B,87C,93C 'attempt':114C 'blueprintu':1A,19B,27B,70C 'build':64B 'compar':95C 'contain':77C 'cve':13A,16A 'edit':31B,74C 'email':9A,37B,61B,91C,102C 'enabl':111C 'enumer':80C,113C 'fail':48B,104C 'flow':46B 'forgotpasswordmiddleware.php':83C 'host':4A,25B,30B,73C 'identifi':89C 'leak':34B 'limit':54B,110C 'list':66B 'lookup':49B,105C 'never':107C 'password':5A,21B,44B,96C 'password-reset':20B 'rate':53B,109C 'rate-limit':52B,108C 'redirect':98C 'regist':12A,68B,90C 'reset':6A,22B,45B,97C 'reveal':7A 'self':3A,24B,29B,72C 'self-host':2A,23B,28B,71C 'submit':101C 'target':99C 'test':59B 'unauthent':56B,86C 'unlimit':60B,112C 'user':69B 'vendor':26B 'vulner':81C 'whether':35B","nicknames":[],"mitigations":[],"who_affected":"Organisations running blueprintUE Self-Hosted Edition before version 4.3.3 with the password reset feature exposed. Hosted or managed blueprintUE instances are outside the scope of this entry, and the sources do not say whether managed deployments are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["blueprintue","medium","passwordreset","selfhosted","vendor"],"campaign_type":null,"first_public_at":"2026-11-04T14:28:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122139","severity":null,"published_at":"2026-11-04T21:18:10+00:00","modified_at":"2026-11-04T21:18:10+00:00","first_seen_at":"2026-11-04T21:49:20+00:00","fetched_at":"2026-11-04T21:49:20+00:00","note":null}],"documents":[{"id":70680,"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":70681,"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":70682,"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-fwgq-c3c6-p67j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-04T14:28:01+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":70683,"url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.3-account-enumeration-via-password-reset","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}