Executive brief
A security flaw in the FuelCMS content management system allows unauthorized individuals to intercept password reset links. By tricking the system into sending a specially crafted email, an attacker can capture the secret token required to change a user's password. This could lead to unauthorized account access and full takeover of the affected website's administrative or user accounts.
Technical details
A password reset poisoning vulnerability exists in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2. The flaw is rooted in a weak password recovery mechanism (CWE-640) where the application likely relies on attacker-controlled Host headers to generate password reset links. An unauthenticated remote attacker can trigger a password reset request for a victim and, by poisoning the Host header, cause the system to generate a reset link pointing to an attacker-controlled domain. If the victim clicks the link in the resulting legitimate email, the secret reset token is leaked to the attacker, enabling unauthorized password changes and account takeover. User interaction (clicking the link) is required for successful exploitation.
Affected products
- Daylight Studio FuelCMS 1.5.2
Timeline
- 2026-04-16: disclosed
- 2026-04-16: advisory