Read the docs
TI-2026-70129 Aliases CVE-2026-107843GHSA-mfxh-vp55-7gc6

Contao registration form resends activation mails without throttling

Priority LOW 30CWE-204Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Denial of service
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-204 and CWE-770.

Summary

Contao from 4.1.0 before 5.3.50 and from 5.4.0-RC1 before 5.7.12 is affected. The registration module runs its follow-up branch on any POST request without checking the form submit flag or the captcha result, and the resend path has no rate limiting (CWE-770). An unauthenticated remote attacker can cause repeated activation emails to be sent to an address with a pending registration and can learn whether that pending registration exists.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to cause repeated activation emails to be sent to an address with a pending registration and to determine whether that pending registration exists. The branch is reachable only when reg_activate is enabled and the target has an unconfirmed registration and opt-in token. This issue is fixed in versions 5.3.50 and 5.7.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Fix Fixed contao (contao): 5.3.50, 5.7.12contao/core-bundle (Packagist): 5.3.50, 5.7.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
contaocontao4.1.0 to before 5.3.50; 5.4.0-RC1 to before 5.7.125.3.50, 5.7.12Patch availableCNA
—contao/core-bundle (Packagist)4.1.0 to before 5.3.505.3.50Patch availableGHSA-mfxh-vp55-7gc6
—contao/core-bundle (Packagist)5.4.0-RC1 to before 5.7.125.7.12Patch availableGHSA-mfxh-vp55-7gc6
  • contao Vendorcontao Affected 4.1.0 to before 5.3.50; 5.4.0-RC1 to before 5.7.12 Fixed in 5.3.50, 5.7.12 Patch available CNA
  • contao/core-bundle (Packagist) Vendor— Affected 4.1.0 to before 5.3.50 Fixed in 5.3.50 Patch available GHSA-mfxh-vp55-7gc6
  • contao/core-bundle (Packagist) Vendor— Affected 5.4.0-RC1 to before 5.7.12 Fixed in 5.7.12 Patch available GHSA-mfxh-vp55-7gc6

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*——contao
  • cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:* Versions — — ·contao

Remediation

Update contao/core-bundle to 5.3.50 for affected releases from 4.1.0 before 5.3.50 and to 5.7.12 for affected releases from 5.4.0-RC1 before 5.7.12. The sources list no fixed version for contao.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA contao (contao) Fixed in 5.3.50, 5.7.12
  • Fix · GHSA-mfxh-vp55-7gc6 contao/core-bundle (Packagist) Fixed in 5.3.50 Advisory →
  • Fix · GHSA-mfxh-vp55-7gc6 contao/core-bundle (Packagist) Fixed in 5.7.12 Advisory →

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-107843
  2. 2026-10-10 Alias added: GHSA-mfxh-vp55-7gc6
  3. 2026-10-10 Fix available: Packagist/contao/[email protected], Packagist/contao/[email protected] · GHSA-mfxh-vp55-7gc6
  4. 2026-10-10 CVSS score added · GHSA-mfxh-vp55-7gc6
  5. 2026-10-10 Weakness changed · GHSA-mfxh-vp55-7gc6
  6. 2026-10-10 5 new references · GHSA-mfxh-vp55-7gc6
  7. 2026-10-13 CISA SSVC decision points changed

References

Other 5

  • TI-2022-09661 Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE)… CVSS 3.1CRITICAL 9.8
  • TI-2024-30849 Unrestricted file upload in Contao CVSS 3.1MEDIUM 6.4
  • TI-2023-18600 Contao cross site scripting vulnerability via input unit widget CVSS 3.1MEDIUM 6.5
  • TI-2014-01453 Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities CVSS 3.1CRITICAL 9.8
  • TI-2022-08709 Cross site scripting via canonical tag CVSS 3.1HIGH 7.2
  • TI-2019-08602 Contao 4.x allows SQL Injection. CVSS 3.0CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences