CVE-2026-26744

MEDIUM

FormaLMS < 4.1.18 - Unauthenticated User Enumeration via Password Recovery Response Discrepancy

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-26744. PoCs published by XiaomingX, lorenzobruno7.

AI-analyzed exploit summary The repository describes a user enumeration vulnerability (CWE-204) in FormaLMS via the `/lostpwd` endpoint, where differential error messages reveal valid usernames. No exploit code is provided, but the technical details are clear and actionable.

Description

A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are registered in the system through observable response discrepancy.

Exploits (2)

github WRITEUP 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-26744

The repository describes a user enumeration vulnerability (CWE-204) in FormaLMS via the `/lostpwd` endpoint, where differential error messages reveal valid usernames. No exploit code is provided, but the technical details are clear and actionable.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: FormaLMS (4.1.18 and below)
No auth needed
Prerequisites: access to the `/lostpwd` endpoint
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WRITEUP
by lorenzobruno7 · poc
https://github.com/lorenzobruno7/CVE-2026-26744

The repository describes a user enumeration vulnerability (CWE-204) in FormaLMS via the `/lostpwd` endpoint, where differential error messages reveal valid usernames. No exploit code is provided, but the technical details are clear and actionable.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: FormaLMS (4.1.18 and below)
No auth needed
Prerequisites: access to the `/lostpwd` endpoint
devstral-2 · analyzed May 04, 2026 Full analysis →

Scores

CVSS v3 5.3
EPSS 0.0029
EPSS Percentile 20.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-204
Status published
Products (1)
formalms/formalms < 4.1.18
Published Feb 19, 2026
Tracked Since Feb 20, 2026