A user enumeration vulnerability has been identified in the password recovery functionality of FormaLMS. When an attacker accesses the /lostpwd endpoint, the application returns distinct error messages for valid and invalid usernames. This observable difference allows an unauthenticated attacker to infer whether a username exists in the system, potentially facilitating targeted phishing or credential stuffing attacks. This vulnerability is a CWE‑204 Information Exposure weakness, where sensitive information about the existence of user accounts is disclosed through differing error messages.

This issue affects FormaLMS versions 4.1.18 and earlier. The CVE source indicates the application is the official FormaLMS distribution; the affected versions are all releases up to but not including 4.1.19.

The CVSS score of 5.3 indicates a medium severity vulnerability. EPSS is less than 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Attackers can enumerate user accounts remotely over HTTP without authentication, which may lead to credential compromise or facilitate social‑engineering attacks. No easy bypass or privilege escalation is reported, but the information gain can be valuable in broader attack campaigns.