The flaw resides in the forgot password API of Totara Learning Management System (LMS) releases 19.1.5 and earlier, where no rate limiting is applied to the target email address. An attacker can trigger an arbitrary number of password‑reset emails to a chosen account, overwhelming the mailbox and disrupting legitimate use. The vendor states that the pwresettime configuration defaults to 30 minutes and that a hard‑control flag ("PWRESET_STATUS_ALREADYSENT") blocks additional reset emails once it is active for a specific address, yet documented behavior still permits rapid successive requests before the flag is set.

Totara Learning Management System versions 19.1.5 and earlier are affected; no other vendor or product variants are listed.

The CVSS base score of 9.8 indicates a very high severity, and the EPSS score of less than 1 % suggests the current exploitation likelihood is low. This vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the publicly exposed, unauthenticated API endpoint that accepts any email address; an attacker can directly target any account without prior credentials.