Description

Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack. NOTE: this is disputed by the Supplier because (1) local login is enabled/disabled server side (this is not a client side control); (2) there is no evidence SSO login can be bypassed to allow local login; and (3) there is no evidence that local login can be performed when disabled server side.

INFO

Published Date :

2026-04-13T00:00:00.000Z

Last Modified :

2026-05-06T06:10:30.341Z

Source :

mitre
AFFECTED PRODUCTS

The following products are affected by CVE-2026-31282 vulnerability.

Vendors Products
Totara
  • Lms
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-31282.

URL Resource
https://github.com/saykino/CVE-2026-31282 cve-icon cve-icon
https://www.totara.com/ cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact