PT-2026-20941 · Forma Lms · Forma Lms

Lorenzo Bruno · Published 2026-02-19 · Updated 2026-02-24 · CVE-2026-26744

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FormaLMS versions 4.1.18 and below

Description A flaw exists in the password recovery functionality of FormaLMS that allows for user enumeration. An unauthenticated attacker can determine valid registered usernames by observing differing error messages returned by the application. This is accessible via the /lostpwd API endpoint. The application reveals whether a username exists based on the response received.

Recommendations Versions prior to 4.1.18 should be updated.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2026-26744

Affected Products

Forma Lms

References · 7

• 🔥 https://github.com/lorenzobruno7/CVE-2026-26744 · Exploit
• https://osv.dev/vulnerability/CVE-2026-26744 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26744 · Security Note
• ❌ https://github.com/formalms/formalms.git · Note, Deleted
• https://t.me/cveNotify/153029 · Telegram Post
• https://twitter.com/UndercodeUpdate/status/2024990552576385106 · Twitter Post
• https://twitter.com/CVEnew/status/2026265070573871318 · Twitter Post