An unauthorized attacker can obtain a valid password reset token for a user by placing a crafted link in an email that the victim receives. This flaw, classified as CWE‑640, is a user authentication weakness that allows the attacker to retrieve the token and subsequently reset the victim’s account password. The exposure enables a full compromise of user credentials, leading to loss of confidentiality, integrity, and availability of the victim’s account and any data protected by it.

The vulnerability affects Daylight Studio FuelCMS version 1.5.2. No other vendors or product versions were identified as impacted.

The flaw can be exploited by any actor who can send a crafted link to a target’s inbox. The attacker does not need elevated privileges or special system access—simply delivering an email containing the forged link is sufficient. Because the reset token is exposed to the external author of the email, the attack can be performed in a low‑complexity manner. The vulnerability has a CVSS score of 7.1, an EPSS score is not available; it is not listed in the CISA KEV catalog. The attack vector is inferred to be email‑based, leveraging a lack of verification that the reset token originates from the legitimate user’s mailbox.