Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are registered in the system through observable response discrepancy.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-20 | 1 | General1 |
| 2026-02-24 | 1 | Disclosure1 |
CVE-2026-26744 A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application retu… https://www.cve.org/CVERecord?id=CVE-2026-26744
Post summary
The CVE record announces a user enumeration flaw in FormaLMS's password recovery endpoint, but provides no PoC, exploit, or patch details.
🚨 #CVE-2026-26744: How a Small Bug Bump Can Lead to Big Security Wins + Video https://undercodetesting.com/cve-2026-26744-how-a-small-bug-bump-can-lead-to-big-security-wins-video/ Educational Purposes!
Post summary
The post merely promotes an educational video about CVE-2026-26744 without offering any PoC, exploit details, mitigation, or technical specifics.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | formalms | formalms | - | - | - |