---
id: CVE-2026-121735
title: >-
  blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation
  Tokens
summary: >-
  blueprintUE self-hosted edition before 4.3.4 contains an insufficient session
  expiration vulnerability that allows attackers to confirm accounts using stale
  tokens because UserModel::findUserIDWithConfirmedToken ignores
  confirmed_sent_at…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-613
vendor: blueprintue
product: blueprintue-self-hosted-edition
affected:
  - blueprintue-self-hosted-edition < 4.3.4
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:55:39.265Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121735'
references:
  - url: >-
      https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/8bba1615bf76b144ac5cd72637c243490f08bc37
    label: Patch Commit
  - url: 'https://github.com/blueprintue/blueprintue-self-hosted-edition'
  - url: >-
      https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-qp6g-7v4v-33r9
    label: GitHub Security Advisory (GHSA-qp6g-7v4v-33r9)
  - url: 'https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/266'
  - url: >-
      https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.3/app/models/UserModel.php#L361-L368
  - url: >-
      https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4
    label: blueprintUE v4.3.4 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.4-non-expiring-account-confirmation-tokens
    label: >-
      VulnCheck Advisory: blueprintUE Self-Hosted Edition before 4.3.4
      Non-Expiring Account Confirmation Tokens
tags:
  - cve.org
epss: 0.0023
epssPercentile: 0.13909
ingestedAt: '2026-11-05T20:33:06.611Z'
---

## Overview

blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.

## Affected

- `blueprintue-self-hosted-edition < 4.3.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.