CVE-2026-53453: CWE-862: Missing Authorization in ha-china blueprint-studio
Blueprint Studio, a VS Code-like editor for Home Assistant configuration files, had a missing authorization vulnerability prior to version 2.5.2. This flaw allowed any authenticated Home Assistant user, not just administrators, to access backend API actions intended for admins only. Exploitable surfaces included APIs for uploading, streaming, terminal WebSocket, service calls, template rendering, file access, and more. A non-admin user could perform unauthorized actions such as invoking arbitrary services, modifying configuration files, and accessing sensitive data, potentially compromising the confidentiality, integrity, and availability of the Home Assistant installation. The issue is fixed in version 2.5.2.
AI Analysis
Technical Summary
CVE-2026-53453 is a missing authorization vulnerability (CWE-862) in ha-china's Blueprint Studio prior to version 2.5.2. The backend API did not consistently enforce admin-only authorization boundaries, exposing administrator-intended actions to any authenticated user. Affected components include backend API, upload API, stream routes, terminal WebSocket, WebSocket subscriptions, call_service, render_template, global_replace, file and stream access, upload handling, and terminal helpers. This allowed non-admin users to invoke arbitrary Home Assistant services, expose state data, modify configuration files, and access streamed or downloaded content. The vulnerability impacts confidentiality, integrity, and availability of the Home Assistant environment. The flaw was addressed and fixed in version 2.5.2.
Potential Impact
Any authenticated user could bypass intended admin-only restrictions and perform sensitive operations such as invoking arbitrary services, modifying configuration files, accessing streamed or downloaded configuration content, and interacting with terminal helpers. This could lead to unauthorized disclosure of sensitive information, unauthorized changes to system configuration, and potential disruption of Home Assistant services, affecting confidentiality, integrity, and availability.
Mitigation Recommendations
This vulnerability is fixed in Blueprint Studio version 2.5.2. Users should upgrade to version 2.5.2 or later to remediate this issue. No additional mitigation steps are required once the upgrade is applied.
CVE-2026-53453: CWE-862: Missing Authorization in ha-china blueprint-studio
Description
Blueprint Studio, a VS Code-like editor for Home Assistant configuration files, had a missing authorization vulnerability prior to version 2.5.2. This flaw allowed any authenticated Home Assistant user, not just administrators, to access backend API actions intended for admins only. Exploitable surfaces included APIs for uploading, streaming, terminal WebSocket, service calls, template rendering, file access, and more. A non-admin user could perform unauthorized actions such as invoking arbitrary services, modifying configuration files, and accessing sensitive data, potentially compromising the confidentiality, integrity, and availability of the Home Assistant installation. The issue is fixed in version 2.5.2.
CVSS v4.0
Score 8.7high
Affected software
ha-china
blueprint-studio
pkg:github/ha-china/blueprint-studioRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-53453 is a missing authorization vulnerability (CWE-862) in ha-china's Blueprint Studio prior to version 2.5.2. The backend API did not consistently enforce admin-only authorization boundaries, exposing administrator-intended actions to any authenticated user. Affected components include backend API, upload API, stream routes, terminal WebSocket, WebSocket subscriptions, call_service, render_template, global_replace, file and stream access, upload handling, and terminal helpers. This allowed non-admin users to invoke arbitrary Home Assistant services, expose state data, modify configuration files, and access streamed or downloaded content. The vulnerability impacts confidentiality, integrity, and availability of the Home Assistant environment. The flaw was addressed and fixed in version 2.5.2.
Potential Impact
Any authenticated user could bypass intended admin-only restrictions and perform sensitive operations such as invoking arbitrary services, modifying configuration files, accessing streamed or downloaded configuration content, and interacting with terminal helpers. This could lead to unauthorized disclosure of sensitive information, unauthorized changes to system configuration, and potential disruption of Home Assistant services, affecting confidentiality, integrity, and availability.
Mitigation Recommendations
This vulnerability is fixed in Blueprint Studio version 2.5.2. Users should upgrade to version 2.5.2 or later to remediate this issue. No additional mitigation steps are required once the upgrade is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-09T16:31:21.494Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a84ca1ac6e8be0332c0b16b
Added to database: 08/18/2026, 21:09:46 UTC
Last enriched: 09/11/2026, 14:31:54 UTC
Last updated: 10/03/2026, 02:46:05 UTC
Views: 54
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.