# CVE-2026-30458: Daylight Studio FuelCMS password reset token exfiltration via mail splitting

Source: https://junglewise.ai/threats/cve-2026-30458-daylight-studio-fuelcms-password-reset-token-exfiltration-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-26. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-30458 · Severity: critical · CVSS 9.1 · Published 2026-03-26

Daylight Studio FuelCMS, a content management system used for building websites, contains a critical security flaw in its password reset process. An attacker can exploit this to intercept the secret tokens used to reset user passwords, potentially allowing them to take over any user account, including administrative ones. This could lead to unauthorized access to sensitive website data and full control over the site's content.

Technologies: [Daylight Studio FuelCMS](https://junglewise.ai/threats/technologies/fuelcms). Vendors: [Daylight Studio](https://junglewise.ai/threats/vendors/daylight-studio).

## Quick answers

**Is CVE-2026-30458 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30458 being exploited in the wild.

**How severe is CVE-2026-30458?** Critical severity, with a CVSS score of 9.1, published 26 March 2026.

**Which products and versions are affected?** Daylight Studio FuelCMS 1.5.2.

**Is there a fix for CVE-2026-30458?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-30458 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-30458?** Check whether you run Daylight Studio FuelCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Daylight Studio FuelCMS v1.5.2 allows for account takeover via a mail splitting attack during the password reset process. The flaw, classified as CWE-620 (Unverified Password Change), stems from improper handling of email inputs, potentially through an email array injection or header manipulation. A remote, unauthenticated attacker can exploit this to redirect or BCC password reset emails to an attacker-controlled address, thereby obtaining the reset token. With this token, the attacker can reset the password for any user account. The project is currently marked as no longer in active development on GitHub, suggesting a patch may not be forthcoming.

## Affected products

- Daylight Studio FuelCMS 1.5.2

## Timeline

- 2026-03-26: disclosed: Initial NVD publication date
- 2026-07-04: advisory: Last modified date in NVD record

## References

- [http://fuelcms.com/](http://fuelcms.com/)
- [https://github.com/daylightstudio/FUEL-CMS](https://github.com/daylightstudio/FUEL-CMS)
- [https://pentest-tools.com/PTT-2025-025-Account-Takeover-via-Email-Array.pdf](https://pentest-tools.com/PTT-2025-025-Account-Takeover-via-Email-Array.pdf)

## Related threats

- [Daylight Studio FuelCMS code injection in Dwoo parser](https://junglewise.ai/threats/cve-2026-30457-daylight-studio-fuelcms-code-injection-in-dwoo-parser)