Description

In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack. NOTE: the Supplier's position is that the pwresettime configuration defaults to 30 minutes, the pwresettime configuration is a hard control enforced via flag PWRESET_STATUS_ALREADYSENT, and no further password-reset email messages are sent if this flag is active for a specific email address.

INFO

Published Date :

2026-04-13T00:00:00.000Z

Last Modified :

2026-04-24T07:32:30.441Z

Source :

mitre
AFFECTED PRODUCTS

The following products are affected by CVE-2026-31283 vulnerability.

Vendors Products
Totara
  • Lms
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-31283.

URL Resource
https://github.com/saykino/CVE-2026-31283 cve-icon cve-icon
https://totara.com/ cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact