CVE-2026-31282
Last modified
CVE-2026-31282 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack. NOTE: this is disputed by the Supplier because (1) local login is enabled/disabled server side (this is not a client side control); (2) there is no evidence SSO login can be bypassed to allow local login; and (3) there is no evidence that local login can be performed when disabled server side.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-31282?
How severe is CVE-2026-31282?
How do I fix CVE-2026-31282?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-31266Craft CMS 5.9.5 and earlier contains a Missing Authorization…7.3
- CVE-2026-31267Mercusys MW302R MW302R(EU)_V1_1.4.10 Build 231023 is vulnera…5.7
- CVE-2026-31271megagao production_ssm v1.0 contains an authorization bypass…9.8
- CVE-2026-31272MRCMS 3.1.2 contains an access control vulnerability. The sa…9.8
- CVE-2026-31280An issue in the Bluetooth RFCOMM service of Parani M10 Motor…6.5
- CVE-2026-31281Totara LMS v19.1.5 and before is vulnerable to HTML Injectio…8
- CVE-2026-31283In Totara LMS v19.1.5 and before, the forgot password API do…9.8
- CVE-2026-3130Improper Enforcement of Behavioral Controls in Devolutions S…9.8
- CVE-2026-31309Improper authorization in the /tequilapi/config/user endpoin…9.8
- CVE-2026-3131Improper access control in multiple DVLS REST API endpoints…6.5
- CVE-2026-31313An authenticated stored cross-site scripting (XSS) vulnerabi…5.4
- CVE-2026-31317Craftql v1.3.7 and before is vulnerable to Server-Side Reque…7.5
Are you affected by CVE-2026-31282?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST