Home / Vulnerability Intelligence / CVE-2026-30458

CVE-2026-30458 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: March 28, 2026

Daylight Studio FuelCMS - Information Disclosure

Published: March 26, 2026Updated: March 28, 2026Remote Exploitable

Overview

Daylight Studio FuelCMS v1.5.2 contains a mail splitting vulnerability caused by improper handling of email headers, letting attackers exfiltrate users' password reset tokens, exploit requires sending crafted emails.

Severity & Score

Severity: Critical

CVSS Score: 9.1

Impact

Attackers can steal password reset tokens, potentially leading to account takeover.

Mitigation

Update to the latest version of FuelCMS.

References

http://daylight.com
http://fuelcms.com
https://github.com/daylightstudio/FUEL-CMS
https://pentest-tools.com/PTT-2025-025-Account-Takeover-via-Email-Array.pdf

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-30458
Severity: Critical
CVSS Score: 9.1
Type: mail_splitting
Status: new

CWE

CWE-620

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N