An issue in Daylight Studio FuelCMS v1.5.2 permits attackers to extract users’ password reset tokens through an email splitting technique. The vulnerability allows malicious actors to obtain tokens that would normally be protected, thereby enabling them to reset passwords without authorization. This directly undermines confidentiality and integrity of user accounts, posing a high risk of compromise.

The affected system is Daylight Studio’s FuelCMS, specifically version 1.5.2. Users running this version of the CMS are exposed, regardless of deployment environment, because the flaw resides in the core token management feature.

The flaw carries a CVSS score of 9.1, indicating critical severity, while the EPSS score is below 1 percent, suggesting a low current exploitation probability. It is not listed in the CISA KEV catalog. The vulnerability can be leveraged remotely by sending crafted requests that manipulate the email handling logic to trigger token exfiltration, implying that users who receive such requests may be at immediate risk.