CVE-2026-53453: Blueprint Studio API authorization bypass for non-admin Home Assistant users
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization boundary. Affected surfaces included the backend API, upload API, stream routes, terminal WebSocket, Blueprint Studio WebSocket subscriptions, callservice, rendertemplate, globalreplace, file and stream access paths, upload handling, and terminal helpers. A non-admin user could invoke arbitrary Home Assistant services, expose Home Assistant state through templates, modify configuration files, access streamed or downloaded configuration content, upload files, or reach terminal-related helpers. These actions could compromise the confidentiality, integrity, and availability of the Home Assistant installation. This issue is fixed in version 2.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Home Assistant Blueprint Studioto a version that resolves this vulnerability.Fixed in 2.5.2
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Home Assistant installations with Blueprint Studio versions earlier than 2.5.2 are affected if a non-admin user can authenticate to Home Assistant. The bypass exposed backend functions intended only for the admin-only panel to authenticated non-admin accounts.
What access does an attacker need to exploit the bypass?
An attacker needs a valid authenticated Home Assistant account that is not an administrator; no administrator role is required. That account could invoke exposed API and WebSocket functions to call services, render templates, read or stream configuration content, modify files, upload files, and access terminal-related helpers.
What should administrators do if they cannot patch immediately?
Upgrade Blueprint Studio to version 2.5.2, which fixes the authorization enforcement issue. If upgrading cannot happen immediately, restrict or remove non-admin Home Assistant accounts that could authenticate to the affected installation.
How can administrators assess whether their installation may already be affected?
Review whether Blueprint Studio is installed at a version earlier than 2.5.2 and whether non-admin Home Assistant users have authenticated access. Investigate activity involving Blueprint Studio API or WebSocket routes, service calls, template rendering, configuration file or stream access, uploads, global replacements, and terminal-related functions by non-admin accounts.