Maksisoft Gym EUVD-2026-89948

Exploitation requires only network reachability to a Maksisoft Gym instance that exposes an account-referencing endpoint (login, registration, or password-reset) which returns observably different responses for existing versus non-existing accounts; no authentication (PR:N) and no user interaction (UI:N) are needed. Limiting factors: the impact is confidentiality-only (C:L) enumeration rather than direct account compromise, the attacker must already possess or generate candidate usernames/emails to test, and the affected instance must be running a vulnerable version (0.5.10 up to but not including 0.5.11) and be network-accessible to the attacker; the small, regionally-concentrated deployment base further constrains realistic targeting.

This is a low-to-moderate real-world risk that reads accurately as a CVSS-5.3 medium - genuinely medium, not an inflated critical. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is internally consistent with the CWE-204 (observable response discrepancy) classification and the 'Account Footprinting' description: a remote, unauthenticated attacker can differentiate valid from invalid accounts based on differing application responses, but the impact is confined to a limited confidentiality leak (C:L) with no integrity or availability effect. No EPSS score, KEV listing, SSVC decision data, or POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The primary risk driver is not this flaw's direct impact but its role as a precursor: username/account enumeration meaningfully improves the success rate of downstream credential-stuffing, password-spraying, and phishing against the identified accounts. Set against that, the affected product - Maksisoft Gym, a single Turkish vendor's gym-management application - has a small deployment footprint, which sharply limits mass-exploitation appeal. Net: low-to-medium priority; patch in routine cycles unless the specific deployment is internet-exposed and high-value.

A remote unauthenticated attacker probes the Maksisoft Gym login or password-reset endpoint with a list of candidate usernames/emails and observes that responses differ measurably (message text, HTTP status, or timing) for valid versus invalid accounts. By enumerating which accounts exist, the attacker builds a validated target list and then launches focused credential-stuffing or phishing against confirmed members/staff. No POC was provided in the input, and no authentication or user interaction is required (PR:N/UI:N).