CVE-2026-30459

Modified Modified - Updated After Analysis

Password Reset Token Disclosure in Daylight Studio FuelCMS v

Publication date: 2026-04-16

Last updated on: 2026-07-05

Assigner: MITRE

Description

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-16

Last Modified

2026-07-05

Generated

2026-07-06

AI Q&A

2026-04-16

EPSS Evaluated

2026-07-05

NVD

CVE-2026-30459

EUVD

EUVD-2026-23231

Affected Vendors & Products

Vendor	Product	Version / Range
thedaylightstudio	fuel_cms	1.5.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Forgot Password feature of Daylight Studio FuelCMS version 1.5.2. It allows unauthenticated attackers to obtain the password reset token of a victim user by using a specially crafted link embedded in a valid email message.

Impact Analysis

An attacker exploiting this vulnerability can gain access to a victim's password reset token without authentication. This could allow the attacker to reset the victim's password and potentially take over their account, leading to unauthorized access to sensitive information or services.

Compliance Impact

This vulnerability allows unauthenticated attackers to obtain password reset tokens via a crafted link, potentially leading to unauthorized access to user accounts.

Such unauthorized access risks compromising user data confidentiality and integrity, which can negatively impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.

However, specific impacts on compliance are not detailed in the provided information.

Hi! I’m here to help you understand CVE-2026-30459. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70