CVE-2026-31283 PUBLISHED

Assigner: mitre
Reserved: 09.03.2026 Published: 13.04.2026 Updated: 13.04.2026

In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack.

Product Status

Vendor n/a
Product n/a
Versions
  • Version n/a is affected

References

Problem Types

  • n/a text