lorenzobruno7/cve-2026-26744Demonstrates user enumeration in FormaLMS via response discrepancy on the /lostpwd endpoint, enabling unauthenticated username discovery for targeted attacks.
A user enumeration vulnerability exists in FormaLMS (4.1.18 and below) in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames (e.g., "The username you've inserted doesn't exist. Please check and retry." for non-existent users), allowing an unauthenticated attacker to determine which usernames are registered in the system through observable response discrepancy (CWE-204).
This information can be leveraged to conduct targeted brute-force or credential stuffing attacks.
Discovered by Lorenzo Bruno, January 2026.
