CVE Feed

    Dashboard / CVE / CVE-2026-122139

    CVE-2026-122139

    blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.

    Published:Nov 4, 2026
    Last Modified:Nov 4, 2026
    EPS:Nov 4, 2026
    EPSS Score:
    CVSS Score:5.3

    Affected Products

    Vendor
    Blueprintue
    Product
    Blueprintue-self-hosted-edition

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-204 Observable Response Discrepancy

    Related CVEs

    CVE-2026-122138 (CVSS 6.3) — BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMi…
    CVE-2026-121735 (CVSS 6.3) — blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that al…
    CVE-2026-40588 (CVSS 8.1) — blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/{…
    CVE-2026-40587 (CVSS 6.5) — blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their password via…
    CVE-2026-40586 (CVSS 7.5) — blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no thr…
    CVE-2026-40585 (CVSS 7.4) — blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High