Medium 6.9

blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in...

CVE-2026-122139 First seen on SecPulse Nov 5, 05:36

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
blueprintue	blueprintueblueprintue-self-hosted-edition	< 4.3.3→ 4.3.3	4.3.3

Original description The description as published by the source.

blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4: Medium 6.9; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Published: Nov 5, 2026
First seen on SecPulse: Nov 5, 05:36
GHSA: GHSA-6v33-jwgx-fxf7
CWE: CWE-204

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

PHP

All

CWE-204 Blueprintue Blueprintue Self Hosted Edition

Detection sources

NIST National Vulnerability DatabaseNov 10, 02:17
GitHub Security Advisories (Global)Nov 5, 06:32
CVE.org (CVE Program・cvelistV5)Nov 10, 01:59