Description
In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack.
INFO
Published Date :
2026-04-13T00:00:00.000Z
Last Modified :
2026-04-14T16:32:37.891Z
Source :
mitre
AFFECTED PRODUCTS
The following products are affected by CVE-2026-31283 vulnerability.
| Vendors | Products |
|---|---|
| Totara |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-31283.
