CVE-2026-107843 json
Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check
published 2026-10-09 30 d ago modified 2026-10-16 23 d ago also GHSA-mfxh-vp55-7gc6 , EUVD-2026-95973
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to cause repeated activation emails to be sent to an address with a pending registration and to determine whether that pending registration exists. The branch is reachable only when reg_activate is enabled and the target has an unconfirmed registration and opt-in token. This issue is fixed in versions 5.3.50 and 5.7.12.
Patch / fix
- packagist contao/core-bundle 5.3.50, 5.7.12
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 26 d ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | contao/core-bundle | >=4.1.0, <5.3.50 >=5.4.0-RC1, <5.7.12 |
5.3.50 5.7.12 |
Affected products
- contao contao
Classification
References
Sources
- CVE List CVE-2026-107843
- GitHub Advisory GHSA-mfxh-vp55-7gc6
- NVD CVE-2026-107843
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.