CVE-2026-122139: blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset
blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
blueprintUE Self-Hosted Editionto a version that resolves this vulnerability.Fixed in 4.3.3
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
Any unauthenticated remote attacker can exploit it. They only need to submit email addresses through the password-reset workflow and compare the resulting redirect targets.
Are unsuccessful password-reset requests throttled?
No. Failed account lookups are never rate-limited, so an attacker can make unlimited attempts to enumerate registered email addresses.
How can I determine whether an instance is affected?
Instances of blueprintUE Self-Hosted Edition earlier than 4.3.3 are affected. You can also test whether the password-reset flow returns different redirect targets for registered versus unregistered email addresses.