{"id":"CVE-2026-107843","summary":"Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check","details":"Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to cause repeated activation emails to be sent to an address with a pending registration and to determine whether that pending registration exists. The branch is reachable only when reg_activate is enabled and the target has an unconfirmed registration and opt-in token. This issue is fixed in versions 5.3.50 and 5.7.12.","aliases":["GHSA-mfxh-vp55-7gc6"],"modified":"2026-10-14T02:30:36.066812081Z","published":"2026-10-09T19:21:32.011Z","database_specific":{"cwe_ids":["CWE-204","CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107843.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/contao/contao/releases/tag/5.3.50"},{"type":"WEB","url":"https://github.com/contao/contao/releases/tag/5.7.12"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107843.json"},{"type":"ADVISORY","url":"https://github.com/contao/contao/security/advisories/GHSA-mfxh-vp55-7gc6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107843"},{"type":"FIX","url":"https://github.com/contao/contao/commit/2ea6117f9049db7221679251cfc41e67d941a74b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/contao/contao","events":[{"introduced":"a112b68dcb5215b01f2c4c4b8de6bcb3d3b9ae81"},{"introduced":"c5e3841e5107ab36ae2bf7795fb8d51d3d30f88b"},{"fixed":"a11109b60dedcbd99e32a4e8550afdadb500f2c5"},{"fixed":"a6543f49a92187a7368f51b290179c4795386e23"},{"fixed":"2ea6117f9049db7221679251cfc41e67d941a74b"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"4.1.0"},{"fixed":"5.3.50"},{"introduced":"5.4.0-RC1"},{"fixed":"5.7.12"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107843.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}