CVE-2020-26167

9.8 criticalEPSS 3.4%

Critical (9.8) in thedaylightstudio fuel cms. EPSS 3.4% chance of exploitation in the next 30 days.

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
Published: 2020-11-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

thedaylightstudio:fuel_cms

References

https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-26167
https://excellium-services.com/cert-xlm-advisory/cve-2020-26167/
https://github.com/daylightstudio/FUEL-CMS/
https://thedaylightstudio.com/
https://www.getfuelcms.com/

Check your stack JSON