CVE-2026-40588 | blueprintue blueprintue-self-hosted-edition up to 4.1.x Password Change /profile/{slug}/edit/ current_password unverified password change (GHSA-73f2-p9jr-m44x)

A vulnerability categorized as critical has been discovered in blueprintue blueprintue-self-hosted-edition up to 4.1.x. The affected element is an unknown function of the file /profile/{slug}/edit/ of the component Password Change Handler. Such manipulation of the argument current_password leads to unverified password change.

This vulnerability is uniquely identified as CVE-2026-40588. The attack can be launched remotely. No exploit exists.

It is advisable to upgrade the affected component.