Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-122139blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset

Medium 5.3

In plain English

A medium-severity security flaw in blueprintue-self-hosted-edition from blueprintue. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 71.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.

Affected products (as reported)

Vendor	Product	Versions
blueprintue	blueprintue-self-hosted-edition	0 – before 4.3.3

Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-fwgq-c3c6-p67j) vendor-advisory
https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2 patch
https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/265 patch, issue-tracking
blueprintue-self-hosted-edition v4.3.3 Release Notes release-notes
https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.2/app/middlewares/ForgotPasswordMiddleware.php#L130-L157 technical-description
VulnCheck Advisory: blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset third-party-advisory