An observable response discrepancy in Maksisoft Gym allows an attacker to discover valid usernames through account footprinting. The vulnerability is described as a response difference between existing and non‑existing accounts, enabling enumeration of accounts. This weakens confidentiality by revealing which users exist and can be leveraged for targeted credential guessing or social engineering attacks. The weakness is identified as CWE‑204.

Maksisoft Gym, a web based fitness management application from Maksisoft Technology, IT and Software Industry and Trade Inc., is affected in all releases before 0.5.11, specifically versions 0.5.10 and earlier.

The CVSS score of 5.3 indicates moderate impact, with no publicly available EPSS score. The vulnerability is not listed in CISA KEV and the attack vector is inferred as network based, typical of web application interfaces that return differing responses to user enumeration attempts. The exploit would require remote access to the application’s authentication interface and would allow an attacker to enumerate valid usernames, but would not give direct code execution or privileged access without further steps.