Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121735blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens

Low 3.7

In plain English

A low-severity security flaw in blueprintue-self-hosted-edition from blueprintue. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.2%top 86.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.

Affected products (as reported)

Vendor	Product	Versions
blueprintue	blueprintue-self-hosted-edition	0 – before 4.3.4

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Patch Commit patch
https://github.com/blueprintue/blueprintue-self-hosted-edition product
GitHub Security Advisory (GHSA-qp6g-7v4v-33r9) vendor-advisory
https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/266 patch, issue-tracking
https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.3/app/models/UserModel.php#L361-L368 technical-description
blueprintUE v4.3.4 Release Notes release-notes
VulnCheck Advisory: blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens third-party-advisory