blueprintue-self-hosted-edition vulnerabilities
CVEs whose affected-version data names the blueprintue-self-hosted-edition package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-122138Medium· 5.3BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing ag…
CVE-2026-122139Medium· 5.3blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset
blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset…
CVE-2026-121735Low· 3.7blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at…