What is the CVSS score of CVE-2026-51926?

CVE-2026-51926 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of FSM Client are affected by CVE-2026-51926?

docuForm GmbH FSM Client v11.11c exposes which user accounts exist in your system to unauthenticated attackers, providing a curated target list for credential-stuffing and brute-force campaigns.

How to fix or mitigate CVE-2026-51926?

Within 24 hours: implement rate-limiting on login.php endpoints (maximum 5 failed attempts per 10 seconds per IP) and randomize login response timing to mask username enumeration signals. Within 7 days: deploy account lockout policies (lock accounts for 30 minutes after 10 failed login attempts) and configure Web Application Firewall rules to detect and block enumeration patterns. Within 30 days: monitor docuForm GmbH security advisories for patch availability; when released, upgrade FSM Client to the patched version.

FSM Client CVE-2026-51926

HIGH

Observable Discrepancy (CWE-203)

2026-07-09 cve@mitre.org

PHP Information Disclosure

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Remote unauthenticated with low complexity (AV:N/AC:L/PR:N/UI:N), but only account-existence metadata leaks, so confidentiality is C:L not C:H and I/A are N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:10 vuln.today

CVE Published

Jul 09, 2026 - 21:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 09, 2026 - 21:16 cve.org

HIGH 7.5

DescriptionCVE.org

An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive information via the login.php component. A vulnerability was identified in the authentication mechanism that allows user enumeration through the login interface. An attacker can differentiate between valid and invalid usernames based on variations in server responses. This information can be leveraged to identify existing accounts and facilitate further attacks, including brute-force or credential stuffing.

AnalysisAI

Username enumeration in docuForm GmbH FSM Client v11.11c lets remote unauthenticated attackers distinguish valid from invalid accounts by observing differences in the login.php responses. The flaw exposes which accounts exist, giving attackers a curated target list to feed into brute-force or credential-stuffing campaigns. No public exploit is identified at time of analysis and EPSS is low (0.25%), though SSVC marks the technique as automatable.

Technical ContextAI

The affected component is the PHP-based login.php authentication handler of docuForm's FSM (Field Service Management / document workflow) Client, a niche German enterprise product. The root cause is CWE-203 (Observable Discrepancy): the login routine returns subtly different responses - error text, HTTP behavior, or response timing - depending on whether a submitted username exists, leaking account-existence state that a secure design would keep uniform. This is a classic information-disclosure side channel in web authentication where valid and invalid credentials should produce indistinguishable failure responses.

Affected ProductsAI

docuForm GmbH FSM Client version 11.11c is confirmed affected, specifically its login.php authentication component. No CPE string was provided in the intelligence data, so the exact version range beyond 11.11c cannot be confirmed. The only vendor reference is the docuForm homepage (https://docuform.de); a second reference points to a third-party gist (https://gist.github.com/ZeroBreach-GmbH) that appears to be the researcher's disclosure. No dedicated vendor advisory URL is present in the data.

RemediationAI

No vendor-released patch version is identified in the provided data - the only vendor reference is the docuForm homepage (https://docuform.de) rather than a fixed release, so administrators should contact docuForm GmbH to confirm whether a corrected build beyond 11.11c exists. As compensating controls, normalize authentication responses so login.php returns identical error messages, HTTP status codes, and timing for valid and invalid usernames (the direct fix for CWE-203); place the login interface behind a VPN or IP allowlist to remove unauthenticated internet exposure; and deploy rate limiting or a WAF rule on login.php to throttle the high-volume automated requests enumeration and downstream brute-force require, accepting that aggressive throttling may affect legitimate users during peak usage. Review the disclosure gist (https://gist.github.com/ZeroBreach-GmbH) to understand the exact response discrepancy being exploited.