GHSA-fwgq-c3c6-p67j: blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset

Published Nov 4, 2026

Updated

blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade blueprintUE Self-Hosted Edition to a version that resolves this vulnerability.
Fixed in 4.3.3

Event History

Nov 4, 2026

CVE Published

via OSV·08:36 PM

Data Sourced

via OSV·08:36 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker can submit password-reset requests and compare the resulting redirect targets to determine whether an email address is registered.

Are failed password-reset lookups rate-limited?

No. Failed lookups are not rate-limited, so an attacker can make unlimited enumeration attempts.

What should be done if upgrading is not immediately possible?

The provided data identifies the distinguishing password-reset redirect behavior and lack of rate limiting, but does not provide a documented workaround. Prioritize upgrading to 4.3.3 or later when possible.

GHSA-fwgq-c3c6-p67j: blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are failed password-reset lookups rate-limited?

What should be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are failed password-reset lookups rate-limited?

What should be done if upgrading is not immediately possible?