CVE-2026-121735 in blueprintUE
Summary
by MITRE • 11/04/2026
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in blueprintUE self-hosted edition prior to version 4.3.4 represents a critical authentication logic flaw rooted in insufficient session expiration mechanisms for account confirmation processes. This issue specifically affects the UserModel::findUserIDWithConfirmedToken function, which is responsible for validating user-provided tokens during the registration workflow. The core technical deficiency lies in the failure of this validation routine to check the confirmed_sent_at timestamp associated with the token against current system time or a defined expiration window. By ignoring this temporal constraint, the application treats confirmation links as perpetually valid regardless of how much time has elapsed since their generation. This design oversight fundamentally undermines the security model intended for new user onboarding, where temporary access credentials are expected to expire after a short period to mitigate risks associated with credential interception or storage exposure.
From an operational perspective, this flaw allows attackers who possess old confirmation links to activate previously unconfirmed accounts indefinitely. These stale tokens can be obtained through various vectors including compromised email inboxes, backups of user data that were not properly secured, or emails forwarded by users themselves. Once an attacker acquires such a token, they can bypass the initial account verification step and gain full access to the newly created profile without needing fresh credentials or re-authentication. This capability effectively neutralizes automated cleanup jobs designed to remove unconfirmed accounts after a set duration, as these jobs rely on the assumption that tokens will eventually become invalid through time-based expiration logic which is currently absent in the validation path.
The security implications of this vulnerability are significant, particularly regarding account takeover and resource abuse. Attackers can register multiple fake accounts using stolen or leaked email addresses by reusing old confirmation links, leading to potential spamming, fraud, or manipulation of platform metrics. Furthermore, if an attacker gains access to a user's historical data where such tokens might be stored in logs or backups, they could retroactively activate dormant accounts associated with those emails. This behavior aligns closely with CWE-613, which describes insufficient session expiration, and maps to the MITRE ATT&CK technique T1078, specifically valid credentials usage for initial access. The lack of time-bound validation transforms what should be a transient state into a persistent entry point for unauthorized account activation.
To mitigate this vulnerability, immediate patching to version 4.3.4 or later is required as it addresses the logic error in token validation. In environments where upgrading is not immediately feasible, administrators should implement compensating controls such as enforcing strict time-based expiration on all confirmation tokens at the database level and ensuring that cleanup jobs actively purge records older than a specific threshold regardless of their confirmed status flags. Additionally, implementing rate limiting on account registration endpoints can help mitigate bulk abuse resulting from this flaw. Security teams should also audit email retention policies to ensure that historical emails containing sensitive authentication links are securely deleted or encrypted, reducing the attack surface for token retrieval via backup exfiltration or mailbox compromise.