Executive brief
Totara LMS, a learning management system used for corporate training and compliance, contains a vulnerability in its password reset functionality. An attacker can repeatedly trigger password reset requests for a specific email address, potentially leading to an 'email bombing' attack that floods a user's inbox. While the vendor disputes the severity by noting that default configurations limit these emails to once every 30 minutes, an exploit could still disrupt communication and impact the availability of the email service for targeted employees.
Technical details
The forgot password API in Totara LMS (v19.1.5 and prior) does not implement sufficient rate limiting for target email addresses. This allows a remote, unauthenticated attacker to programmatically request password resets, leading to resource exhaustion or email bombing (CWE-770). The vendor has disputed the 'Critical' severity, stating that the 'pwresettime' configuration (defaulting to 30 minutes) and the 'PWRESET_STATUS_ALREADYSENT' flag act as hard controls to prevent multiple emails from being sent to the same address within the lockout window. However, third-party assessments (CISA-ADP) assigned a high CVSS score based on the potential for service disruption. Mitigation involves upgrading to versions newer than 19.1.5 or ensuring the password reset timeout configurations are strictly enforced.
Affected products
- Totara Totara LMS <= 19.1.5
Timeline
- 2026-04-13: disclosed: Initial CVE publication
- 2026-04-24: other: Vendor dispute added to CVE description