External risk intelligence

Fuel CMS Password Reset Token Exfiltration via Mail Splitting Attack.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-30458

FUEL CMS is a web-based content management system. As a web application, it is commonly deployed as an internet-facing service to manage website content, making the application's administrative and public-facing interfaces reachable from the internet.

Thedaylightstudio Fuel Cms

1.5.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in Daylight Studio FuelCMS, a content management system used for websites. The issue, which affects a specific version of the software, could potentially allow unauthorized access to sensitive user information, specifically password reset tokens. The main concern is confirming whether your organization uses this affected software and is therefore exposed.

Password reset tokens can be stolen.
Affects web content management system software.
Confirm relevance and exposure; no immediate action.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted emails to a FuelCMS instance. This could allow them to obtain sensitive information, such as user password reset tokens, by manipulating how the system processes email addresses.

No authentication required.
Sending specially crafted emails.
Exfiltrate password reset tokens.

Live Threat

Current exploitation, exposure, and threat context

A mail splitting attack could allow an unauthenticated attacker to exfiltrate password reset tokens when the system is processing user requests for password resets.

User password reset tokens could be exposed.
An attacker could send specially crafted emails.
Unauthorized account access may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability requires immediate attention from teams managing web applications and their underlying infrastructure. The initial focus should be on identifying all instances of the affected product, confirming their exposure and business criticality, and then assigning ownership for remediation. Subsequent steps will involve coordinated efforts to mitigate risk, potentially including vendor engagement and maintenance window planning.

Application owners should lead remediation efforts.
Verify external reachability and business impact.
Plan coordinated updates based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Daylight Studio FuelCMS?

FuelCMS is a web-based content management system (CMS) developed by The Daylight Studio. It provides a framework for developers to build, manage, and update website content. Organizations use it to handle site architecture and administrative workflows, often hosting it as a web application accessible via a browser.

What does CWE-620 mean for CVE-2026-30458?

CWE-620 refers to 'Unverified Password Change,' a weakness where a system fails to properly validate the context of a password reset request. In the context of CVE-2026-30458, this flaw allows an attacker to manipulate how the application handles email processing. By exploiting this, they can trick the system into leaking a user's password reset token, which is a sensitive string intended to prove a user's identity when they regain access to an account.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a specifically formatted request to the CMS during a password reset attempt, leveraging a mail splitting technique. This involves manipulating input fields to confuse the mail server's interpretation of the recipient. It is important to note that this requires the system to be actively processing a reset request; simply having an instance of FuelCMS installed without triggering the reset workflow does not initiate the vulnerability.

Do I need to worry if my instance is not public?

Halo Surface Signal indicates that FuelCMS is typically deployed as an internet-facing service because it manages public-facing website content. If your instance is truly internal and restricted from the internet, the reachability of this attack path is significantly lower. However, you should still confirm if the application is accessible via any non-public entry points, such as VPNs or internal portals, that could still be targeted by an attacker.

How should I respond to this threat?

Your first step is to perform an inventory of your environment to identify all active instances of FuelCMS v1.5.2. Once identified, categorize these assets based on their business criticality and network exposure. Since this is a critical vulnerability, coordinate with your application owners to monitor official vendor channels from The Daylight Studio for patches, while ensuring that access controls to your administrative interfaces are strictly managed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.