This vulnerability in Totara LMS versions up to 19.1.5 involves the forgot password API not implementing rate limiting on password reset requests per email address, which could be abused for Email Bombing attacks. The supplier clarifies that the pwresettime configuration, defaulting to 30 minutes, acts as a hard control using the PWRESET_STATUS_ALREADYSENT flag to block additional password reset emails within that period. No official patch or remediation level is indicated in the available data.

If exploited, an attacker could trigger a large volume of password reset emails to a single email address, potentially leading to denial of service or email inbox flooding. However, the supplier's stated controls limit the frequency of such emails to one per 30 minutes per address, mitigating the risk of rapid repeated abuse. There is no indication of direct compromise of user accounts or data confidentiality, integrity, or availability beyond the email flooding risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The supplier indicates that the pwresettime configuration enforces a 30-minute cooldown between password reset emails per address, which mitigates the risk of Email Bombing. Administrators should verify that this configuration is enabled and functioning as intended. No additional immediate action is specified by the vendor.