PT-2026-32360 · Totara · Totara Lms

Saykino · Published 2026-04-13 · Updated 2026-04-13 · CVE-2026-31283

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totara LMS versions prior to 19.1.5

Description The forgot password API does not implement rate limiting for the target email address, which allows for an Email Bombing attack. Email Bombing is a technique where a large volume of emails is sent to a single address to overwhelm the recipient or the mail server.

Recommendations Update to a version newer than 19.1.5. As a temporary workaround, restrict access to the forgot password API endpoint to minimize the risk of exploitation.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-31283

Affected Products

Totara Lms

References · 5

• 🔥 https://github.com/saykino/CVE-2026-31283 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-31283 · Security Note
• https://totara.com · Note
• https://twitter.com/VulmonFeeds/status/2043698891153965530 · Twitter Post
• https://twitter.com/CVEnew/status/2043733083640447249 · Twitter Post