CVE-2026-26744

A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are registered in the system through observable response discrepancy.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.29% chance of exploitation in the next 30 days, 21th percentile

Published

2026-02-19

Updated

2026-02-24

Proof-of-concept exploits (1)

• lorenzobruno7/CVE-2026-267440★ · 2026-02-19

References

• CVE Record
• NVD entry

Related

• CVE-2026-26740
• CVE-2026-26746
• CVE-2026-26720
• CVE-2026-2676
• CVE-2026-2672
• CVE-2026-26801