A flaw in blueprintUE’s password change interface allows an authenticated user to change their password without providing the current password. Because the form does not verify the user’s existing credentials, once an attacker has an active session they can set a new password and gain full control of the account.

All installations of the blueprintUE Self‑Hosted Edition running a version earlier than 4.2.0 are vulnerable. The patch that fixes the issue is included in release 4.2.0 and later.

The vulnerability carries a CVSS score of 8.1, indicating high severity. Although EPSS data is not available and the issue is not listed in CISA’s KEV catalog, the impact is permanent account takeover, which threatens confidentiality, integrity, and availability of the affected users. Exploitation requires an authenticated session, which an attacker can obtain through XSS exploitation, session side‑jacking over HTTP, physical access to a logged‑in browser, or a stolen “remember me” cookie. Once the attacker has such a session, changing the password is trivial and can be performed without any additional credentials.