CVE-2026-107843

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107843
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107843.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107843
Aliases
Published
2026-10-09T19:21:32Z
Modified
2026-10-14T02:30:36Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check
Details

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to cause repeated activation emails to be sent to an address with a pending registration and to determine whether that pending registration exists. The branch is reachable only when reg_activate is enabled and the target has an unconfirmed registration and opt-in token. This issue is fixed in versions 5.3.50 and 5.7.12.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-204",
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107843.json"
}
References

Affected packages

Git / github.com/contao/contao

Affected ranges

Type
GIT
Repo
https://github.com/contao/contao
Events
Introduced
a112b68dcb5215b01f2c4c4b8de6bcb3d3b9ae81
Introduced
c5e3841e5107ab36ae2bf7795fb8d51d3d30f88b
Fixed
a11109b60dedcbd99e32a4e8550afdadb500f2c5
Fixed
a6543f49a92187a7368f51b290179c4795386e23
Fixed
2ea6117f9049db7221679251cfc41e67d941a74b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.1.0"
        },
        {
            "fixed":  "5.3.50"
        },
        {
            "introduced":  "5.4.0-RC1"
        },
        {
            "fixed":  "5.7.12"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107843.json"