Critical severity · published Nov 4, 2020
CVE-2020-26167
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one
9.8
CVSS
3.4%
EPSS
No
On KEV
Description
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FC
Fuel Cms · Thedaylightstudio
through 1.4.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26167
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26167
cds.thalesgroup.com
https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-26167
Third Party Advisory
https://excellium-services.com/cert-xlm-advisory/cve-2020-26167/
Third Party Advisory
https://github.com/daylightstudio/FUEL-CMS/
Vendor Advisory
https://thedaylightstudio.com/
Product
https://www.getfuelcms.com/
More from Fuel Cms
9.8
CVE-2020-17463
Fuel CMS SQL Injection Vulnerability
9.8
CVE-2026-30457
An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code
9.8
CVE-2020-22153
File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function
9.8
CVE-2020-22151
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function
9.8
CVE-2021-38727
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items