CVE-2026-53453

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2

Description Blueprint Studio fails to consistently enforce the admin-only authorization boundary on its backend, allowing any authenticated Home Assistant user to access actions intended for administrators. This issue affects several surfaces, including the backend API, upload API, stream routes, terminal WebSocket, and Blueprint Studio WebSocket subscriptions. Specifically, the call service, render template, and global replace functions, as well as file and stream access paths, upload handling, and terminal helpers, are exposed. An attacker with non-admin privileges could invoke arbitrary Home Assistant services, expose system state via templates, modify configuration files, access streamed or downloaded content, upload files, or access terminal-related helpers, potentially compromising the confidentiality, integrity, and availability of the installation.

Recommendations Update to version 2.5.2.