CVE-2026-30459
Password Reset Token Disclosure in Daylight Studio FuelCMS v
Publication date: 2026-04-16
Last updated on: 2026-04-23
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| thedaylightstudio | fuel_cms | 1.5.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-640 | The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated attackers to obtain password reset tokens via a crafted link, potentially leading to unauthorized access to user accounts.
Such unauthorized access risks compromising user data confidentiality and integrity, which can negatively impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.
However, specific impacts on compliance are not detailed in the provided information.
Can you explain this vulnerability to me?
This vulnerability exists in the Forgot Password feature of Daylight Studio FuelCMS version 1.5.2. It allows unauthenticated attackers to obtain the password reset token of a victim user by using a specially crafted link embedded in a valid email message.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can gain access to a victim's password reset token without authentication. This could allow the attacker to reset the victim's password and potentially take over their account, leading to unauthorized access to sensitive information or services.