CVE-2020-26167

Published 04 Nov 2020 · Updated 30 May 2025

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 3.4%

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.

Affected products

n/a · n/a

References

https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-26167 https://excellium-services.com/cert-xlm-advisory/cve-2020-26167/https://github.com/daylightstudio/FUEL-CMS/https://thedaylightstudio.com/https://www.getfuelcms.com/