CVE-2026-40588

🗓️ 21 Apr 2026 17:12:08Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 8 Views🌐 WEB

Authenticated password change without current password; session attackers can takeover; fixed 4.2.0.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2026-40588	21 Apr 202619:26	–	circl
CNNVD	blueprintUE self-hosted edition 安全漏洞	21 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-40588 blueprintUE: Authenticated Password Change Does Not Verify Current Password	21 Apr 202617:12	–	cvelist
EUVD	EUVD-2026-24205	21 Apr 202617:12	–	euvd
NVD	CVE-2026-40588	21 Apr 202618:16	–	nvd
Positive Technologies	PT-2026-34036	21 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-40588	22 Apr 202619:22	–	redhatcve
Vulnrichment	CVE-2026-40588 blueprintUE: Authenticated Password Change Does Not Verify Current Password	21 Apr 202617:12	–	vulnrichment

Vulners

Node

blueprintue blueprintue-self-hosted-editionRange<4.2.0

[
  {
    "vendor": "blueprintue",
    "product": "blueprintue-self-hosted-edition",
    "versions": [
      {
        "version": "< 4.2.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-73f2-p9jr-m44x

Parameter	Position	Path	Description	CWE
new_password	request body	/profile/{slug}/edit/	Password change form does not verify current password, allowing an authenticated attacker to change the account password without knowing the original credential.	CWE-620
confirm_password	request body	/profile/{slug}/edit/	Password change form does not verify current password, allowing an authenticated attacker to change the account password without knowing the original credential.	CWE-620

17 Jun 2026 10:45Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.1

EPSS0.00215

SSVC

CWE-620