CVE-2026-30459 describes a vulnerability in Daylight Studio FuelCMS v1.5.2 where the Forgot Password functionality improperly protects the password reset token. An unauthenticated attacker can exploit this by sending a crafted link embedded in a legitimate email message to obtain the reset token of a victim user. This vulnerability is categorized under CWE-640 (Weak Password Recovery Mechanism). No official patch or remediation guidance has been provided as of the published date.

An attacker exploiting this vulnerability can obtain the password reset token of a victim user without authentication, potentially allowing unauthorized password resets. This compromises the confidentiality and integrity of user accounts but does not affect availability. The CVSS vector indicates low attack complexity and no privileges required, with user interaction needed and partial confidentiality impact but high integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with password reset emails and avoid clicking suspicious links. Monitoring for updates from the vendor is recommended.