CVE-2026-107843
Contao: The registration module re-sends activation mails
Impact
Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to cause repeated activation emails to be sent to an address with a pending registration and to determine whether that pending registration exists. The branch is reachable only when reg_activate is enabled and the target has an unconfirmed registration and opt-in token. This issue is fixed in versions 5.3.50 and 5.7.12.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | contao/core-bundle | >= 4.1.0, < 5.3.50 | 5.3.50 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-mfxh-vp55-7gc6
- https://github.com/contao/contao/security/advisories/GHSA-mfxh-vp55-7gc6
- https://github.com/contao/contao/commit/2ea6117f9049db7221679251cfc41e67d941a74b
- https://github.com/contao/contao/releases/tag/5.3.50
- https://github.com/contao/contao/releases/tag/5.7.12