This vulnerability in Daylight Studio FuelCMS v1.5.2 enables remote attackers to steal password reset tokens by exploiting a mail splitting attack vector. The weakness allows unauthorized disclosure of sensitive tokens, potentially leading to account compromise. The CVSS 3.1 base score of 9.1 reflects network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts. There is no indication of availability impact. No patch or vendor advisory is currently provided.

Successful exploitation results in attackers gaining access to password reset tokens, which can be used to reset user passwords and compromise accounts. This leads to a high impact on confidentiality and integrity of user accounts within the affected FuelCMS installation. There is no reported impact on system availability. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the password reset functionality, monitoring for suspicious activity related to password resets, and applying any recommended temporary mitigations from the vendor. Avoid relying on password reset tokens transmitted via email without additional protections.