CVE-2026-51926 describes a user enumeration vulnerability in docuForm GmbH FSM Client v11.11c. The issue exists in the authentication mechanism via the login.php interface, where server response variations allow an unauthenticated remote attacker to determine valid usernames. This vulnerability corresponds to CWE-203 (Information Exposure Through Discrepancy). The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or remediation level is currently documented, and no exploits are known in the wild.

The vulnerability allows an unauthenticated remote attacker to enumerate valid usernames by analyzing differences in server responses during login attempts. This information disclosure compromises confidentiality by revealing existing user accounts, which can be leveraged to conduct targeted brute-force or credential stuffing attacks. There is no direct impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing rate limiting, account lockout policies, or uniform error messages on the login interface to reduce the risk of user enumeration.