Vulnerability record/PUBLISHED/Published Nov 3, 2026 22:55:39 UTC
CVE-2026-121735
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.
Base score6.3/ 10
SeverityMediumCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsPresentAT
Privileges requiredNonePR
User interactionNoneUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityLowVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedNov 9, 2026 15:55:50 UTC
PublishedNov 3, 2026 22:55:39 UTC
ReservedNov 3, 2026 22:17:05 UTC
Credits
- Farhan Khan
- rancoud