DNA View

High Severity Vulnerability

This vulnerability has been rated as High severity. Immediate action is recommended.

CVE-2026-30459

High

Low Medium High Critical

7.1

CVSS Score

Published: Apr 16, 2026

Last Modified: Apr 23, 2026

CWE: CWE-640

Vulnerability Description

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Known Affected Software

1 configuration(s) from 1 vendor(s)

fuel_cms

Version:

1.5.2

CPE:

cpe:2.3:a:thedaylightstudio:fuel_cms:1.5.2:*:*:*:*:*:*:*

This vulnerability affects 1 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

7.1

out of 10.0

High

Weakness Type (CWE)

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

Description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Exploit Likelihood: High
Typical Severity: High
Abstraction Level: Base