What’s Vulnerable › Vulnerabilities

CVE-2026-26744

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-19 · updated 2026-06-17
• Weakness: CWE-204

Description

A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are registered in the system through observable response discrepancy.

Affected products

• Forma LMS: through 4.1.18

References

• https://github.com/formalms/formalms.git
• https://github.com/lorenzobruno7/CVE-2026-26744

Get alerted when CVE-2026-26744 or the next vulnerability affects your stack