CVE-2026-30459 describes a security flaw in Daylight Studio FuelCMS v1.5.2 where the Forgot Password functionality can be exploited by unauthenticated attackers. By placing a crafted link within a valid email message, an attacker can retrieve the password reset token of a targeted user. This vulnerability could lead to unauthorized access if the token is used maliciously. There is no CVSS score assigned, no vendor advisory or patch information available, and the affected versions are not explicitly detailed beyond v1.5.2.

The vulnerability allows unauthorized disclosure of password reset tokens, which could enable attackers to reset user passwords and gain unauthorized access to user accounts. However, no known exploits have been reported, and the extent of impact depends on whether attackers can successfully leverage the crafted link in practice.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with password reset emails and avoid clicking on suspicious links. Monitoring for updates from the vendor is recommended.