A critical vulnerability in blueprintUE self-hosted edition allows an authenticated attacker to perform a full account takeover by bypassing password verification during the update process.

This vulnerability, classified as CWE-620, exists in the password change form at the /profile/{slug}/edit/ endpoint. It permits any authenticated user to reset another user's password without requiring the existing password, effectively granting full control over the target account.

Successful exploitation of this flaw leads to full account takeover, which can result in unauthorized access to sensitive proprietary Unreal Engine project data and source code. With a CVSS score of 8.1, the high severity reflects the potential for complete loss of confidentiality and integrity regarding user accounts and the associated intellectual property.

Immediate Action: Update the blueprintUE self-hosted edition to version 4.2.0 or later immediately to implement the required password verification logic.

Proactive Monitoring: Review web access logs for anomalous activity directed at the /profile/ endpoint, specifically monitoring for frequent password change requests originating from non-standard user sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to restrict access to account management endpoints and enforce strict session management policies to reduce the likelihood of session hijacking, which is a prerequisite for this exploit.

Public Exploit Available: No.

Given the high CVSS score and the direct impact on account security, administrators must prioritize this update. Ensure that all instances of the self-hosted edition are patched to version 4.2.0 to prevent unauthorized account takeovers and the subsequent compromise of project assets.