CVE-2026-122139
5.3 MEDIUMpublic exploit availablePublished 2026-11-04 · Updated 2026-11-04
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-204
Public exploit & PoC references
- https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.2/app/middlewares/ForgotPasswordMiddleware.php#L130-L157
- https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2
- https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/265
- https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.3
- https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-fwgq-c3c6-p67j
All references
- https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.2/app/middlewares/ForgotPasswordMiddleware.php#L130-L157
- https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2
- https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/265
- https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.3
- https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-fwgq-c3c6-p67j
- https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.3-account-enumeration-via-password-reset
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2024-7478
- HIGHCVE-2026-100164
- LOWCVE-2026-102587
- LOWCVE-2026-103526
- MEDIUMCVE-2026-104439PoC
- MEDIUMCVE-2026-105664PoC
- MEDIUMCVE-2026-107843PoC
- MEDIUMCVE-2026-109206PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.