CVE-2026-30458 is a critical vulnerability in Daylight Studio FuelCMS v1.5.2 that enables remote attackers to exfiltrate password reset tokens by exploiting a mail splitting attack. This vulnerability does not require privileges or user interaction and affects the confidentiality and integrity of user accounts. The vulnerability is categorized under CWE-620, which involves improper validation of password reset tokens, potentially allowing unauthorized access to user accounts. No patch or official fix information is currently available for this version.

Successful exploitation of this vulnerability allows attackers to obtain password reset tokens, which can lead to unauthorized account access and compromise of user credentials. The confidentiality and integrity of user accounts are severely impacted, but availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users of Daylight Studio FuelCMS v1.5.2 should consider restricting access to password reset functionality or implementing additional monitoring for suspicious activity related to password resets. Avoid exposing the affected version to untrusted networks if possible.