CVE-2026-31282 describes an incorrect access control vulnerability in Totara LMS v19.1.5 and earlier. The issue involves manipulation of the login page code to expose the login form, which, when combined with missing rate limiting on login attempts, could facilitate brute force attacks. The supplier disputes the vulnerability's impact, emphasizing server-side controls that prevent unauthorized local login and SSO bypass. No patch or official remediation has been published as of now.

If exploitable, this vulnerability could allow an unauthenticated attacker to perform brute force attacks against user accounts due to the exposed login form and lack of rate limiting, potentially leading to unauthorized access with full confidentiality, integrity, and availability impact. However, the supplier disputes the feasibility of such exploitation due to server-side controls that restrict local login and prevent SSO bypass, which may mitigate the risk in practice.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The supplier disputes the vulnerability's impact based on server-side controls. Until official guidance or patches are released, administrators should verify local login settings and consider implementing external rate limiting or login attempt restrictions if possible.