CVE-2026-122139

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122139", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T18:13:13.537Z", "datePublished": "2026-11-04T20:36:56.508Z", "dateUpdated": "2026-11-09T16:59:06.617Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T20:36:56.508Z"}, "datePublic": "2026-11-04T14:28:01.000Z", "title": "blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset", "descriptions": [{"lang": "en", "value": "blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Observable Response Discrepancy", "cweId": "CWE-204", "type": "CWE"}]}], "affected": [{"vendor": "blueprintue", "product": "blueprintue-self-hosted-edition", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "4.3.3", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:github/blueprintue/blueprintue-self-hosted-edition", "repo": "https://github.com/blueprintue/blueprintue-self-hosted-edition"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-fwgq-c3c6-p67j", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-fwgq-c3c6-p67j)"}, {"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2", "tags": ["patch"]}, {"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/265", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.3", "tags": ["release-notes"], "name": "blueprintue-self-hosted-edition v4.3.3 Release Notes"}, {"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.2/app/middlewares/ForgotPasswordMiddleware.php#L130-L157", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.3-account-enumeration-via-password-reset"}], "credits": [{"lang": "en", "value": "Farhan Khan", "type": "finder"}, {"lang": "en", "value": "rancoud", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:33:47.943050Z", "id": "CVE-2026-122139", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:59:06.617Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122139", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T16:33:47.943050Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:14:19.438Z"}}], "cna": {"title": "blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset", "credits": [{"lang": "en", "type": "finder", "value": "Farhan Khan"}, {"lang": "en", "type": "remediation developer", "value": "rancoud"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"repo": "https://github.com/blueprintue/blueprintue-self-hosted-edition", "vendor": "blueprintue", "product": "blueprintue-self-hosted-edition", "versions": [{"status": "affected", "version": "0", "lessThan": "4.3.3", "versionType": "semver"}], "packageURL": "pkg:github/blueprintue/blueprintue-self-hosted-edition", "defaultStatus": "unaffected"}], "datePublic": "2026-11-04T14:28:01.000Z", "references": [{"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-fwgq-c3c6-p67j", "name": "GitHub Security Advisory (GHSA-fwgq-c3c6-p67j)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2", "tags": ["patch"]}, {"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/265", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.3", "name": "blueprintue-self-hosted-edition v4.3.3 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.2/app/middlewares/ForgotPasswordMiddleware.php#L130-L157", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.3-account-enumeration-via-password-reset", "name": "VulnCheck Advisory: blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "Observable Response Discrepancy"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T20:36:56.508Z"}}}, "cveMetadata": {"cveId": "CVE-2026-122139", "state": "PUBLISHED", "dateUpdated": "2026-11-09T16:59:06.617Z", "dateReserved": "2026-11-04T18:13:13.537Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-04T20:36:56.508Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/blueprintue/blueprintue-self-hosted-edition", "product": "blueprintue-self-hosted-edition", "repo": "https://github.com/blueprintue/blueprintue-self-hosted-edition", "vendor": "blueprintue", "versions": [{"lessThan": "4.3.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts."}], "id": "CVE-2026-122139", "lastModified": "2026-11-12T21:36:06.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122139", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:33:47.943050Z", "version": "2.0.3"}}]}, "published": "2026-11-04T21:18:10.203", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.2/app/middlewares/ForgotPasswordMiddleware.php#L130-L157"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/265"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.3"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-fwgq-c3c6-p67j"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.3-account-enumeration-via-password-reset"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-204"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.3.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "blueprintue-self-hosted-edition", "source": "cna", "vendor": "blueprintue"}, "product": "blueprintue-self-hosted-edition", "vendor": "blueprintue"}], "created": "2026-11-04T22:15:15.088916+00:00", "updated": "2026-11-04T23:15:15.784237+00:00", "vendors": ["blueprintue", "blueprintue$PRODUCT$blueprintue-self-hosted-edition"]}