Unscored CVE-2020-26167 EUVD-2020-18792GHSA-xqh9-89v8-g968

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an ad…

Published Nov 4, 2020 · Updated May 30, 2025 · Assigned by mitre

Description

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.

References

https://excellium-services.com/cert-xlm-advisory/cve-2020-26167/
https://www.getfuelcms.com/
https://github.com/daylightstudio/FUEL-CMS/
https://thedaylightstudio.com/
https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-26167