---
id: CVE-2026-122139
title: >-
  blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password
  Reset
summary: >-
  blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration
  vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated
  attackers to identify registered email addresses. Attackers can compare
  password reset…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-204
vendor: blueprintue
product: blueprintue-self-hosted-edition
affected:
  - blueprintue-self-hosted-edition < 4.3.3
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T20:36:56.508Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122139'
references:
  - url: >-
      https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-fwgq-c3c6-p67j
    label: GitHub Security Advisory (GHSA-fwgq-c3c6-p67j)
  - url: >-
      https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2
  - url: 'https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/265'
  - url: >-
      https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.3
    label: blueprintue-self-hosted-edition v4.3.3 Release Notes
  - url: >-
      https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.2/app/middlewares/ForgotPasswordMiddleware.php#L130-L157
  - url: >-
      https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.3-account-enumeration-via-password-reset
    label: >-
      VulnCheck Advisory: blueprintUE Self-Hosted Edition before 4.3.3 Account
      Enumeration via Password Reset
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.565Z'
---

## Overview

blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.

## Affected

- `blueprintue-self-hosted-edition < 4.3.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.