CVE-2026-126659

Name of the Vulnerable Software and Affected Versions BlueprintUE Self-Hosted Edition versions 1.0.0 through 4.3.4

Description An issue exists where unauthenticated attackers can cause resource exhaustion by repeatedly creating anonymous blueprints to fill server storage. This is achieved by sending large requests to the HomeController::doProcessCreateBlueprint() function with the expiration variable set to 'never', which bypasses automatic purges and leads to a denial of service.

Recommendations Update BlueprintUE Self-Hosted Edition to version 4.3.5 or later. As a temporary mitigation, restrict access to the HomeController::doProcessCreateBlueprint() function.