CVE-2026-30458

Critical · CVSS 9.1

Daylight Studio FuelCMS — Password reset token exfiltration via mail splitting attack

CVSS: 9.1; nvd
EPSS: 0.40%; 32th pct
KEV: No
Class: other; CWE-620

Description

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

Search profile — drives PoC discovery

Symbols password_reset_tokenmail_splittingemail_arrayreset_passwordforgot_passwordsend_reset_emailfuel_authFUEL-CMS

Keywords CVE-2026-30458FuelCMSFuelCMS 1.5.2mail splitting attackpassword reset token exfiltrationaccount takeover email arrayPTT-2025-025CWE-620FUEL-CMS password resetdaylightstudio FUEL-CMS

Versions: 1.5.2

References

https://github.com/daylightstudio/FUEL-CMS
https://pentest-tools.com/PTT-2025-025-Account-Takeover-via-Email-Array.pdf

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T06:30:39.000Z