CVE-2026-30459
Received Received - Intake
Password Reset Token Disclosure in Daylight Studio FuelCMS v

Publication date: 2026-04-16

Last updated on: 2026-04-23

Assigner: MITRE

Description
An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-16
Last Modified
2026-04-23
Generated
2026-06-16
AI Q&A
2026-04-16
EPSS Evaluated
2026-06-15
NVD
CVE-2026-30459
EUVD
EUVD-2026-23231
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
thedaylightstudio fuel_cms 1.5.2
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Forgot Password feature of Daylight Studio FuelCMS version 1.5.2. It allows unauthenticated attackers to obtain the password reset token of a victim user by using a specially crafted link embedded in a valid email message.

Compliance Impact

This vulnerability allows unauthenticated attackers to obtain password reset tokens via a crafted link, potentially leading to unauthorized access to user accounts.

Such unauthorized access risks compromising user data confidentiality and integrity, which can negatively impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.

However, specific impacts on compliance are not detailed in the provided information.

Impact Analysis

An attacker exploiting this vulnerability can gain access to a victim's password reset token without authentication. This could allow the attacker to reset the victim's password and potentially take over their account, leading to unauthorized access to sensitive information or services.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-30459. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart