CVE Feed

    Dashboard / CVE / CVE-2026-121735

    CVE-2026-121735

    blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.

    Published:Nov 3, 2026
    Last Modified:Nov 4, 2026
    EPS:Nov 3, 2026
    EPSS Score:
    CVSS Score:3.7

    Affected Products

    Vendor
    Blueprintue
    Product
    Blueprintue-self-hosted-edition

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-122139 (CVSS 6.9) — blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMi…
    CVE-2026-122138 (CVSS 6.3) — BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMi…
    CVE-2026-40588 (CVSS 8.1) — blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/{…
    CVE-2026-40587 (CVSS 6.5) — blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their password via…
    CVE-2026-40586 (CVSS 7.5) — blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no thr…
    CVE-2026-40585 (CVSS 7.4) — blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High