{"id":"CVE-2026-126659","kind":"vulnerability","aliases":["CVE-2026-126659"],"related":[],"title":"BlueprintUE Self-Hosted: anonymous blueprint uploads fill server disk","description":"BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to HomeController::doProcessCreateBlueprint() with a 'never' expiration, bypassing purges to fill the disk and deny service.","summary":"BlueprintUE Self-Hosted Edition before 4.3.5 lets unauthenticated users create anonymous blueprints that never expire, and the purge routine does not clear them. An attacker can keep submitting large requests until the server's storage is full, denying service to everyone else.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["blueprintue","other","self-hosted"],"not_affected_if":["managed-hosting","version-4.3.5-or-later"],"how_to_check":"- Check the installed BlueprintUE Self-Hosted version against `4.3.5`; anything below that in the `1.0.0` to `4.3.5` range is affected.\n- Review the anonymous blueprint creation path (HomeController::doProcessCreateBlueprint) and whether requests with a 'never' expiration are accepted.","fix":"- BlueprintUE Self-Hosted: move to `4.3.5` or later (fixed version per NVD description).","status":"open","published_at":"2026-11-11T13:17:24+00:00","first_seen_at":"2026-11-11T13:27:16+00:00","triaged_at":"2026-11-11T13:29:08+00:00","updated_at":"2026-11-11T13:29:08+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T13:29:08Z","model":"claude-haiku-5-5","output":{"fix":"- BlueprintUE Self-Hosted: move to `4.3.5` or later (fixed version per NVD description).","reach":"internet","title":"BlueprintUE Self-Hosted: anonymous blueprint uploads fill server disk","impact":"medium","summary":"BlueprintUE Self-Hosted Edition before 4.3.5 lets unauthenticated users create anonymous blueprints that never expire, and the purge routine does not clear them. An attacker can keep submitting large requests until the server's storage is full, denying service to everyone else.","audience":"businesses","category":"other","nicknames":[],"who_cares":["blueprintue","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated users fill server storage and cause denial of service","analyst_note":"Confirm the fixed version and whether anonymous blueprint creation is on by default, using the linked vendor advisory and patch pages.","how_to_check":"- Check the installed BlueprintUE Self-Hosted version against `4.3.5`; anything below that in the `1.0.0` to `4.3.5` range is affected.\n- Review the anonymous blueprint creation path (HomeController::doProcessCreateBlueprint) and whether requests with a 'never' expiration are accepted.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["managed-hosting","version-4.3.5-or-later"],"who_is_affected":"Teams that run BlueprintUE Self-Hosted Edition on their own infrastructure with anonymous blueprint creation reachable from the internet or their network. Instances on managed hosting or at 4.3.5 and later are not affected by this description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000787,"input_tokens":4669,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126659':13A,16A '-2026':12A,15A '1.0.0':70C '4.3.5':28B,72C 'allow':79C 'anonym':5A,33B,89C 'attack':47B,81C,91C 'blueprint':6A,34B,90C 'blueprintu':1A,17B,22B,65C 'bypass':103C 'clear':44B 'contain':73C 'creat':32B,88C 'cve':11A,14A 'deni':60B,110C 'disk':10A,108C 'doprocesscreateblueprint':98C 'edit':26B,69C 'els':64B 'everyon':63B 'exhaust':76C 'expir':37B,102C 'fill':8A,83C,106C 'full':59B 'homecontrol':97C 'host':4A,21B,25B,68C 'keep':49B 'larg':51B,94C 'let':29B 'never':36B,101C 'purg':40B,104C 'repeat':87C 'request':52B,95C 'resourc':75C 'routin':41B 'self':3A,20B,24B,67C 'self-host':2A,19B,23B,66C 'send':93C 'server':9A,55B,84C 'servic':61B,111C 'storag':57B,85C 'submit':50B 'unauthent':30B,80C 'upload':7A 'user':31B 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Teams that run BlueprintUE Self-Hosted Edition on their own infrastructure with anonymous blueprint creation reachable from the internet or their network. Instances on managed hosting or at 4.3.5 and later are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["blueprintue","high","other","selfhosted"],"campaign_type":null,"search_a":"'-126659':13A,16A '-2026':12A,15A 'anonym':5A 'blueprint':6A 'blueprintu':1A 'cve':11A,14A 'disk':10A 'fill':8A 'host':4A 'self':3A 'self-host':2A 'server':9A 'upload':7A","search_b":"'4.3.5':28B 'anonym':33B 'attack':47B 'blueprint':34B 'blueprintu':17B,22B 'clear':44B 'creat':32B 'deni':60B 'edit':26B 'els':64B 'everyon':63B 'expir':37B 'full':59B 'host':21B,25B 'keep':49B 'larg':51B 'let':29B 'never':36B 'purg':40B 'request':52B 'routin':41B 'self':20B,24B 'self-host':19B,23B 'server':55B 'servic':61B 'storag':57B 'submit':50B 'unauthent':30B 'user':31B","search_c":"'1.0.0':70C '4.3.5':72C 'allow':79C 'anonym':89C 'attack':81C,91C 'blueprint':90C 'blueprintu':65C 'bypass':103C 'contain':73C 'creat':88C 'deni':110C 'disk':108C 'doprocesscreateblueprint':98C 'edit':69C 'exhaust':76C 'expir':102C 'fill':83C,106C 'homecontrol':97C 'host':68C 'larg':94C 'never':101C 'purg':104C 'repeat':87C 'request':95C 'resourc':75C 'self':67C 'self-host':66C 'send':93C 'server':84C 'servic':111C 'storag':85C 'unauthent':80C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:59:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126659","severity":null,"published_at":"2026-11-11T13:17:24+00:00","modified_at":"2026-11-11T13:17:24+00:00","first_seen_at":"2026-11-11T13:27:16+00:00","fetched_at":"2026-11-11T13:27:16+00:00","note":null}],"documents":[{"id":125685,"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/0709b39851bf58febccf0bc74b88fa86070410de","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":125686,"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.5","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":125687,"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-q2vm-p36g-w596","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T17:59:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":125688,"url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-1.0.0-before-4.3.5-storage-exhaustion-via-anonymous-blueprints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}