blueprintUE Self-Hosted Edition is a collaboration service for Unreal Engine blueprints. GHSA-fwgq-c3c6-p67j describes an account-enumeration flaw in the password-reset endpoint of version 4.3.2. Registered accounts and unregistered addresses produce different redirects. Failed lookups also do not consume the configured rate-limit counters. Version 4.3.3 fixes both behaviors.

The service may be deployed on an internal network or behind a company-specific hostname. Public discovery is therefore likely to be small. The risk still matters because a reset endpoint is an unauthenticated path into account-state logic.

I ran two ZoomEye count-only queries on November 13, 2026, at about 06:50 China Standard Time. Both used sub_type=all, page 1, and page size 1. The app query app="blueprintUE" returned 0 matches. The title query title="blueprintUE" returned 11 matches.

The app result does not show that blueprintUE is absent from ZoomEye. It may indicate that the self-hosted edition has no distinct application fingerprint in the indexed response. The 11 title matches are a small candidate set that still requires ownership checks. A title can belong to a public demo, a documentation page, or a private service whose login page is visible.

Inventory the reset path

Map the public matches to internal systems where possible. Record the hostname, owner, deployment environment, and exposed authentication routes. Compare that list with the organization's source-control, build, and collaboration inventories.

Test the reset form with an approved account and an invalid address. Compare redirects, response bodies, cookies, and timing. Then repeat the request enough times to verify that failed lookups consume the rate limit. Use a controlled environment so the test does not spam real users.

Review the email-delivery path as well. A uniform redirect can still be undermined by different response times or different mail behavior. The fixed release applies the rate limit before lookup and rolls back the transaction when the address is missing or delivery fails.

Limit the exposed surface

Upgrade to 4.3.3 or later. Restrict self-hosted blueprintUE to the users and networks that need it. If external access is required, put the service behind an identity-aware proxy and review whether the reset form is reachable without an organization login.

Search logs for repeated reset requests with changing email values and stable clients. Correlate the activity with failed logins and support tickets. The endpoint may be used by legitimate users who forgot which address they registered. A high volume becomes meaningful when it is concentrated or follows a list-like pattern.

The completion check should include the fixed version, identical public reset responses, rate-limit tests that count failed lookups, and a reviewed network path. A count of 11 title matches is a manageable discovery workload. It should lead to ownership evidence, not a conclusion that every page is an affected account portal.

References