The vulnerability in Totara LMS v19.1.5 and prior versions involves the forgot password API not implementing rate limiting controls on requests targeting the same email address. This absence of throttling enables an attacker to abuse the password reset functionality to send a large volume of emails to a single user, constituting an Email Bombing attack. No patch or official remediation level has been published as of the current data. The issue is documented under CVE-2026-31283 with no CVSS score assigned.

The primary impact is the potential for Email Bombing attacks against users of affected Totara LMS versions, which can lead to denial of service via email flooding of the victim's inbox. There is no indication of direct compromise of user accounts or system integrity from this vulnerability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider implementing external rate limiting or monitoring on the forgot password API endpoint to prevent abuse. Additionally, users should be informed about potential phishing or spam risks associated with repeated password reset emails.