CVE-2026-122139
blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in…
- Risk score
- 42/100
- CVSS
- 5.3 v3.1
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited,…
- Affected
- See advisory
- Fix
- Upgrade the product to 4.3.3 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.3 medium
- On your watchlist: php
References
- https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.2/app/middlewares/ForgotPasswordMiddleware.php#L130-L157
- https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2
- https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/265
- https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.3
- https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-fwgq-c3c6-p67j
- https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.3-account-enumeration-via-password-reset
Original description
blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.
Last activity 4 Nov 2026. Patch Forecast updates every hour.