What is the CVSS score of CVE-2026-30458?

CVE-2026-30458 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of N A are affected by CVE-2026-30458?

Organizations using Daylight Studio FuelCMS face critical risk from CVE-2026-30458 rated CVSS 9.1.

How to fix or mitigate CVE-2026-30458?

Within 24 hours: Identify all affected systems running Daylight Studio FuelCMS and apply vendor patches immediately. Monitor vendor channels for patch availability.

N A CVE-2026-30458

EUVD-2026-16303 CRITICAL

Unverified Password Change (CWE-620)

2026-03-26 mitre

GHSA-8vgv-ffv5-269j

Information Disclosure N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 19:00 euvd

EUVD-2026-16303

Analysis Generated

Mar 26, 2026 - 19:00 vuln.today

CVE Published

Mar 26, 2026 - 00:00 nvd

CRITICAL 9.1

DescriptionCVE.org

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

AnalysisAI

Daylight Studio FuelCMS v1.5.2 allows remote attackers to exfiltrate password reset tokens through a mail splitting attack, enabling account takeover without authentication. The vulnerability exploits improper handling of email headers during the password reset workflow, permitting attackers to intercept or redirect sensitive reset tokens to attacker-controlled addresses. No public exploit code or active exploitation has been independently confirmed at time of analysis.

Technical ContextAI

FuelCMS is a lightweight content management system built on CodeIgniter framework. The vulnerability exists in the password reset token generation and email delivery mechanism. Mail splitting attacks (also known as CRLF injection or email header injection) occur when user input is insufficiently sanitized before being passed to email header parameters, allowing attackers to inject carriage return and line feed (CRLF) sequences to manipulate email routing. This represents a failure in input validation and output encoding at the email generation layer. While specific CWE mapping was not provided in the intelligence data, this attack pattern typically correlates with CWE-93 (Improper Neutralization of CRLF Sequences in HTTP Headers) or CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected product is identified via vendor repositories at https://github.com/daylightstudio/FUEL-CMS and http://fuelcms.com.

RemediationAI

Immediate actions: Contact Daylight Studio and FuelCMS maintainers via http://fuelcms.com or the GitHub repository (https://github.com/daylightstudio/FUEL-CMS) to request an updated patch version addressing the mail splitting vulnerability. Until a patched version is released and deployed, implement compensating controls: sanitize all user input destined for email headers using strict whitelisting (alphanumeric characters only for email addresses), encode output using proper email header encoding standards (RFC 2047), and implement a Web Application Firewall (WAF) rule to block requests containing CRLF sequences (%0D%0A, \r\n) in parameters used in email operations. Review server logs for suspicious password reset requests and consider disabling password reset functionality temporarily if alternative authentication mechanisms (LDAP, SSO) are available. No vendor-released patch version has been independently confirmed from available data; coordinate directly with the FuelCMS security team for patch availability and timeline.