CVE-2026-30458: Critical severity Daylight Studio FuelCMS vulnerability

Published Mar 26, 2026

Updated

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

Affected Software

2 affected components

Daylight Studio FuelCMS=1.5.2

TheDayLightStudio Fuel CMS=1.5.2

Mar 26, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeaknessAffected Software

CVE-2026-30458 has a critical severity rating of 9.1.

To mitigate CVE-2026-30458, upgrade to a patched version of Daylight Studio FuelCMS that addresses the mail splitting vulnerability.

CVE-2026-30458 involves a mail splitting attack that can lead to the exfiltration of password reset tokens.

CVE-2026-30458 affects Daylight Studio FuelCMS version 1.5.2.

Attackers can exfiltrate users' password reset tokens, potentially enabling unauthorized access to accounts.