CVE-2026-30459: 
Fuel CMS vulnerability analysis and mitigation

CVE-2026-30459 is a weak password recovery vulnerability in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 that allows unauthenticated attackers to obtain a victim user's password reset token via a crafted link embedded in a legitimate-looking email message. The vulnerability was published on April 16, 2026, and affects FuelCMS version 1.5.2 specifically. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) and is associated with CAPEC-50 (Password Recovery Exploitation). The attack vector is network-based and exploits the password reset flow in fuel/modules/fuel/controllers/Login.php, where the pwd_reset() function generates a reset token and constructs a reset URL using fuel_url() — which may incorporate the HTTP Host header without adequate validation. An attacker can perform Host Header Injection by sending a crafted request that causes the password reset email to contain a malicious link pointing to an attacker-controlled server; when the victim clicks the link, the reset token is disclosed to the attacker. User interaction is required (the victim must click the poisoned link), and no privileges are needed to initiate the attack (GitHub Advisory, FUEL-CMS Login.php, Pentest Tools PDF).

Successful exploitation allows an attacker to capture a valid password reset token for any user whose email address is known, enabling them to reset that user's password and gain full unauthorized access to the victim's FuelCMS account. The confidentiality impact is low (only the token is directly exposed), but the integrity impact is high, as the attacker can take over the account and modify CMS content, user settings, or administrative configurations. Availability is not directly impacted, but account takeover of an administrator account could lead to broader compromise of the CMS-managed website (GitHub Advisory, Feedly).

There is no confirmed public exploit code or evidence of in-the-wild exploitation at this time; the referenced PDF from Pentest Tools describes the Host Header poisoning technique generically but was assessed as non-exploitable in the context of this CVE (Feedly). The EPSS score is approximately 0.025% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify a target FuelCMS v1.5.2 instance and obtain the email address of a victim user (e.g., an administrator) through public sources, registration pages, or enumeration.
2. Craft the malicious request: Send an HTTP POST request to the FuelCMS password reset endpoint (/fuel/login/pwd_reset) with the victim's email address in the email field, while manipulating the Host header to point to an attacker-controlled server (e.g., Host: attacker.com).
3. Trigger token generation: The pwd_reset() function in Login.php generates a reset token and constructs the reset URL using fuel_url(), which incorporates the (poisoned) Host header, resulting in a reset link like http://attacker.com/fuel/login/reset/<token> being sent to the victim's email.
4. Capture the token: When the victim clicks the link in the email, their browser sends a request to the attacker's server, revealing the password reset token in the HTTP request log.
5. Reset the victim's password: Use the captured token to access the legitimate reset URL on the actual FuelCMS instance (/fuel/login/reset/<token>), submit a new password, and gain full access to the victim's account (GitHub Advisory, FUEL-CMS Login.php).

• Network: Outbound HTTP requests from the FuelCMS server to unexpected external domains during password reset operations; password reset email links pointing to domains other than the legitimate CMS hostname.
• Logs: Web server access logs showing POST requests to /fuel/login/pwd_reset with unusual or mismatched Host headers; requests to /fuel/login/reset/<token> originating from IP addresses inconsistent with the victim user's known location or device.
• Application Logs: FuelCMS debug logs (auth_log_pass_reset_request) recording password reset requests for users who did not initiate them; subsequent successful password resets shortly after a reset request from an unexpected IP.
• User Reports: Victim users reporting receipt of unsolicited password reset emails or unexpected account lockouts after a password change they did not perform.

A patch is available via the GitHub Advisory (GHSA-c29w-82wc-qh7v); administrators should update FuelCMS to a patched version as soon as one is released by the vendor (GitHub Advisory). As an interim workaround, configure the web server (Apache/Nginx) to enforce a strict, whitelisted Host header so that the application cannot be tricked into using an attacker-supplied hostname when constructing reset URLs. Additionally, implement email security controls (e.g., link scanning, user awareness) to reduce the likelihood of victims clicking malicious links, and consider adding multi-factor authentication to reduce the impact of account takeover.