CVE-2026-31283

Name of the Vulnerable Software and Affected Versions Totara LMS versions prior to 19.1.5

Description The forgot password API does not implement rate limiting for the target email address, which allows for an Email Bombing attack. Email Bombing is a technique where a large volume of emails is sent to a single address to overwhelm the recipient or the mail server.

Recommendations Update to a version newer than 19.1.5. As a temporary workaround, restrict access to the forgot password API endpoint to minimize the risk of exploitation.