CVE-2026-107843 in Contao
Summary
by MITRE • 10/09/2026
Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to cause repeated activation emails to be sent to an address with a pending registration and to determine whether that pending registration exists. The branch is reachable only when reg_activate is enabled and the target has an unconfirmed registration and opt-in token. This issue is fixed in versions 5.3.50 and 5.7.12.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within Contao, a widely used open-source content management system, represents a critical flaw in its user registration and activation workflow. Specifically affecting versions from 4.1.0 through 5.3.50 and up to 5.7.12, this issue stems from an insufficient verification of form submission integrity within the ModuleRegistration::compile() function. In secure web application design, it is imperative that any action triggered by a POST request validates not only the presence of specific tokens but also ensures that the request originates from a legitimate user interaction flow. The flaw arises because the system fails to verify the FORM_SUBMIT flag or validate the preceding captcha result before proceeding with sensitive operations. This oversight allows an unauthenticated attacker to bypass standard security controls designed to prevent automated abuse and unauthorized actions, effectively treating any POST request targeting the registration module as valid regardless of its origin or context.
The operational impact of this vulnerability is significant, primarily manifesting as a mechanism for email enumeration and denial-of-service through resource exhaustion. When the reg_activate feature is enabled and a target user has an unconfirmed registration with an associated opt-in token, the attacker can exploit the lack of rate limiting in the resendActivationMail() function. By invoking OptInToken::send(), the system repeatedly dispatches activation emails to the specified address. This capability serves two malicious purposes for an adversary. First, it allows for user enumeration; if the email is sent successfully or triggers a specific response indicating success versus failure based on whether a pending registration exists, the attacker can determine with high accuracy whether a particular email address has registered but not yet activated their account. Second, this functionality can be leveraged to harass individuals by flooding them with unwanted emails, constituting a denial-of-service condition against the victim's inbox and potentially impacting the mail server's performance due to the unbounded volume of outgoing messages.
From a technical classification perspective, this vulnerability aligns closely with CWE-284, which describes Improper Access Control, as the system fails to enforce proper restrictions on unauthorized actors performing sensitive operations. Furthermore, it relates to CWE-798, involving the use of hardcoded or weak credentials in some contexts, though more accurately here it reflects a failure in input validation and state management that allows for abuse of core functionality. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior is consistent with techniques used for reconnaissance and enumeration, where an attacker probes systems to gather information about user accounts without needing valid credentials. The lack of rate limiting also touches upon CWE-770, which concerns the allocation of resources without proper limits, allowing attackers to consume system resources excessively.
To mitigate this vulnerability, organizations running affected versions of Contao must upgrade immediately to version 5.3.51 or later for the 5.3 branch and version 5.7.13 or later for the 5.7 branch, as these releases contain the necessary patches to enforce proper form validation and implement rate limiting on activation email requests. For environments where immediate patching is not feasible due to operational constraints, temporary mitigations should include implementing web application firewall rules that restrict POST requests to registration endpoints based on IP reputation or request frequency thresholds. Additionally, administrators can review server-side configurations to ensure that the mail service has its own robust rate-limiting policies in place to prevent abuse even if the application layer is compromised. It is also recommended to audit custom modules and extensions for similar patterns of unchecked form submissions to maintain a holistic security posture across the CMS ecosystem.