CVE-2026-53453
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Blueprint Studio before version 2.5.2 fails to consistently enforce admin-only authorization boundaries, allowing any authenticated user to access admin-intended backend API actions. This includes invoking Home Assistant services, modifying configuration files, accessing streams, and uploading files.
Risk Assessment
The risk includes compromise of confidentiality, integrity, and availability of the Home Assistant installation, as unprivileged users can perform administrative operations.
Recommendation
Upgrade Blueprint Studio to version 2.5.2 or later, which includes the fix for authorization enforcement.
Original NVD description (English source)
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization boundary. Affected surfaces included the backend API, upload API, stream routes, terminal WebSocket, Blueprint Studio WebSocket subscriptions, call_service, render_template, global_replace, file and stream access paths, upload handling, and terminal helpers. A non-admin user could invoke arbitrary Home Assistant services, expose Home Assistant state through templates, modify configuration files, access streamed or downloaded configuration content, upload files, or reach terminal-related helpers. These actions could compromise the confidentiality, integrity, and availability of the Home Assistant installation. This issue is fixed in version 2.5.2.