In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack.Referenceshttps://totara.com/https://github.com/saykino/CVE-2026-31283
