---
id: "CVE-2026-122139"
kind: "vulnerability"
aliases: ["CVE-2026-122139"]
title: "blueprintUE Self-Hosted: password reset reveals which email addresses are registered"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["blueprintue", "password-reset", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "version-4.3.3-or-later"]
published_at: "2026-11-04T21:18:10+00:00"
first_seen_at: "2026-11-04T21:49:20+00:00"
updated_at: "2026-11-04T21:51:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122139", "first_seen_at": "2026-11-04T21:49:20+00:00"}]
exploit_sources: []
---

# blueprintUE Self-Hosted: password reset reveals which email addresses are registered

blueprintUE Self-Hosted Edition before 4.3.3 leaks whether an email address has an account through its password reset flow, and failed lookups are not rate-limited. An unauthenticated attacker can test unlimited email addresses to build a list of registered users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed blueprintUE Self-Hosted version and confirm whether it is below `4.3.3`
- Review `ForgotPasswordMiddleware.php` in the installation for the redirect behaviour described in the advisory

## Fix

- blueprintUE Self-Hosted Edition: `4.3.3` or later

## Timeline

- 2026-11-04T21:49:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122139

## Documents

- [advisory] Vendor advisory: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-fwgq-c3c6-p67j
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.3-account-enumeration-via-password-reset
- [fix] Patch: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2
- [fix] Release notes: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.3

## From the sources

blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_