CVE-2026-121735 blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-121735?
CVE-2026-121735 is a medium-severity vulnerability in blueprintue-self-hosted-edition, published on 3 Nov 2026.
Official description
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.
Weakness: CWE-613
Which versions are affected by CVE-2026-121735?
How do I fix CVE-2026-121735?
No fix has been published for CVE-2026-121735 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-121735 being exploited?
There is no known exploitation of CVE-2026-121735 in the wild and no public exploit code.
Sources
Also known as GHSA-pc87-6hr3-m9jr, GHSA-qp6g-7v4v-33r9.