CVE-2026-107843

MEDIUM 5.3

Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to cause repeated activation emails to be sent to an address with a pending registration and to determine whether that pending registration exists. The branch is reachable only when reg_activate is enabled and the target has an unconfirmed registration and opt-in token. This issue is fixed in versions 5.3.50 and 5.7.12.

CWE	CWE-204 CWE-770
Vendor	contao
Product	contao
Published	Oct 9, 2026

Stay Ahead of the Next One

Get instant alerts for contao contao

Be the first to know when new medium vulnerabilities affecting contao contao are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

contao / contao

>= 4.1.0, < 5.3.50 >= 5.4.0-RC1, < 5.7.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/contao/contao/security/advisories/GHSA-mfxh-vp55-7gc6 github.com: https://github.com/contao/contao/commit/2ea6117f9049db7221679251cfc41e67d941a74b github.com: https://github.com/contao/contao/releases/tag/5.3.50 github.com: https://github.com/contao/contao/releases/tag/5.7.12