6.9
CVSS 4.0
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
Описание
Оригинално описание
blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.
Засегнати продукти
- blueprintue blueprintue-self-hosted-edition: преди 4.3.3
Вид слабост
История
- 4 ноември 2026 Публикувано
Други уязвимости в blueprintue blueprintue-self-hosted-edition
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-122139
- https://nvd.nist.gov/vuln/detail/CVE-2026-122139
- https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-fwgq-c3c6-p67j
- https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2
- https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/265
- https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.3
- https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.2/app/middlewares/ForgotPasswordMiddleware.php#L130-L157
- https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.3-account-enumeration-via-password-reset