Quick answers
- Is CVE-2026-30459 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-30459 being exploited in the wild.
- How severe is CVE-2026-30459?
- High severity, with a CVSS score of 7.1, published 16 April 2026.
- Which products and versions are affected?
- Daylight Studio FuelCMS 1.5.2.
- Is there a fix for CVE-2026-30459?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-30459 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-30459?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A password reset poisoning vulnerability exists in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2. The flaw is rooted in a weak password recovery mechanism (CWE-640) where the application likely relies on attacker-controlled Host headers to generate password reset links. An unauthenticated remote attacker can trigger a password reset request for a victim and, by poisoning the Host header, cause the system to generate a reset link pointing to an attacker-controlled domain. If the victim clicks the link in the resulting legitimate email, the secret reset token is leaked to the attacker, enabling unauthorized password changes and account takeover. User interaction (clicking the link) is required for successful exploitation.
Affected products
- Daylight Studio FuelCMS 1.5.2
Timeline
- 2026-04-16: disclosed
- 2026-04-16: advisory