What is CVE-2026-26744?

CVE-2026-26744 is a medium-severity vulnerability in Formalms, classified under Observable Response Discrepancy. CVSS score: 5.3/10. Published 2026-02-19.

How severe is CVE-2026-26744?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Formalms

CVE-2026-26744

A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are registered in the system through observable response discrepancy.

EPSS: 0.003 (21.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Formalms
N/a — versions n/a

Weakness classification (CWE)

CWE-204 — Observable Response Discrepancy

References

cve@mitre.org (Product)
cve@mitre.org (Third Party Advisory)

Frequently asked questions

What is CVE-2026-26744?: CVE-2026-26744 is a medium-severity vulnerability in Formalms, classified under Observable Response Discrepancy. CVSS score: 5.3/10. Published 2026-02-19.
How severe is CVE-2026-26744?: Medium severity. CVSS v3 base score is 5.3 out of 10.