CVE-2026-30458
Published: 26 March 2026
Summary
CVE-2026-30458 is a critical-severity Unverified Password Change (CWE-620) vulnerability in Thedaylightstudio Fuel Cms. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-30458, published on 2026-03-26, is a vulnerability in Daylight Studio FuelCMS version 1.5.2 that enables attackers to exfiltrate users' password reset tokens via a mail splitting attack. The issue carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and significant impacts on confidentiality and integrity. It is classified under CWE-620.
Unauthenticated remote attackers can exploit this vulnerability over the network without privileges or user interaction. By conducting a mail splitting attack, they can steal password reset tokens, which may facilitate unauthorized access to user accounts, as suggested by the vulnerability's high integrity impact and related reporting on account takeover risks.
Mitigation guidance and additional details are available in vendor and security resources, including http://daylight.com, http://fuelcms.com, https://github.com/daylightstudio/FUEL-CMS, and https://pentest-tools.com/PTT-2025-025-Account-Takeover-via-Email-Array.pdf.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16303
Vulnerability details
An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes unauthenticated remote exploitation of public-facing FuelCMS app via mail splitting to steal password reset tokens, directly enabling T1190 for initial access and facilitating T1078 via resulting account takeover with valid credentials.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the specific flaw in FuelCMS v1.5.2 directly prevents exploitation of the mail splitting vulnerability to exfiltrate password reset tokens.
Validating inputs to password reset functionality prevents email header injection that enables mail splitting attacks and token exfiltration.
Filtering and encoding outputs inserted into email headers prevents manipulation allowing attackers to split emails and steal password reset tokens.