# CVE-2026-122139: blueprintUE Self-Hosted Edition account enumeration in password reset

Source: https://junglewise.ai/threats/cve-2026-122139-blueprintue-self-hosted-edition-before-4-3-3-contains-an-account  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-122139 · Severity: medium · CVSS 5.3 · Published 2026-11-04

blueprintUE Self-Hosted Edition is a web-based collaboration platform deployed on-premises. A flaw in its password reset feature allows attackers to discover which email addresses are registered by observing differences in password reset responses and making unlimited enumeration requests without rate limiting. This information can be used for targeted phishing or account takeover attacks.

Technologies: [BlueprintUE Self-Hosted Edition](https://junglewise.ai/threats/technologies/self-hosted-edition). Vendors: [BlueprintUE](https://junglewise.ai/threats/vendors/blueprintue).

## Quick answers

**Is CVE-2026-122139 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-122139 being exploited in the wild.

**How severe is CVE-2026-122139?** Medium severity, with a CVSS score of 5.3, published 4 November 2026.

**Which products and versions are affected?** BlueprintUE Self-Hosted Edition before 4.3.3.

**Is there a fix for CVE-2026-122139?** Yes: fixed in 4.3.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-122139 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-122139?** Check whether you run BlueprintUE Self-Hosted Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.3.3

## Technical details

An account enumeration vulnerability exists in the ForgotPasswordMiddleware.php component where failed password reset lookups are not rate-limited, while successful lookups may be. Attackers can submit arbitrary email addresses and infer registered accounts based on response differences. The vulnerability requires network access and unauthenticated access to the password reset endpoint, with no user interaction needed beyond submitting emails.

## Affected products

- blueprintUE Self-Hosted Edition before 4.3.3

## Timeline

- 2026-11-04: disclosed

## References

- [https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.2/app/middlewares/ForgotPasswordMiddleware.php](https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.2/app/middlewares/ForgotPasswordMiddleware.php)
- [https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2](https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/45832742182a6c4438a0d58de95ba9c7686851f2)

## Related threats

- [blueprintUE Self-Hosted Edition insecure database default configuration](https://junglewise.ai/threats/cve-2026-126812-blueprintue-self-hosted-edition-before-4-3-7-contains-an)
- [BlueprintUE Self-Hosted Edition resource exhaustion in blueprint creation](https://junglewise.ai/threats/cve-2026-126659-blueprintue-self-hosted-edition-1-0-0-before-4-3-5-contains-a)
- [BlueprintUE Self-Hosted Edition login rate limit bypass](https://junglewise.ai/threats/cve-2026-122138-blueprintue-self-hosted-edition-4-2-0-before-4-3-4-contains-a)