CVE-2026-121735: blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmedsentat. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Self-hosted blueprintUE deployments running versions before 4.3.4 are affected. The issue concerns accounts that remain unconfirmed and for which an attacker can obtain an old account-confirmation link.
What does an attacker need to exploit it?
The attacker needs access to a stale confirmation token, such as one obtained from a compromised mailbox, a backup, or forwarded email. No prior account privileges or user interaction are required.
What is the impact of using a stale confirmation token?
An attacker can confirm an otherwise unconfirmed account after the token should no longer be valid. This can also allow the account to avoid removal by the unconfirmed-account cleanup job.
How can I determine whether an account may have been affected?
Review unconfirmed accounts that were later confirmed and assess whether old confirmation emails, mailbox archives, backups, or forwarded messages could have exposed their confirmation links. The provided information does not identify a specific log event or indicator that proves exploitation.