CVE-2026-31283 Denial of service in n/a
Attackers can trigger email bombing against Totara LMS users due to missing rate limiting on the forgot password API, potentially exhausting email resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31283?
CVE-2026-31283 is a critical denial of service vulnerability in n/a, published on 13 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack. NOTE: the Supplier's position is that the pwresettime configuration defaults to 30 minutes, the pwresettime configuration is a hard control enforced via flag PWRESET_STATUS_ALREADYSENT, and no further password-reset email messages are sent if this flag is active for a specific email address.
Weakness: CWE-770
Which versions are affected by CVE-2026-31283?
How do I fix CVE-2026-31283?
No fix has been published for CVE-2026-31283 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-31283 being exploited?
There is no known exploitation of CVE-2026-31283 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-h2c3-7q37-gjwp.