ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-107843

Contao: The registration module re-sends activation mails

Published Oct 9, 2026 · catalog updated Oct 9, 2026 · Contao: The registration module

Check if you run it

No confirmed exploitation is on record for CVE-2026-107843. EPSS is 0.26%. Act only if a listed version of Contao: The registration module is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Contao: The registration module).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.26%
Remediation
Advisory link
Affected products
Packagist contao/core-bundle

reaches its follow-up registration branch on **any** POST to a page carrying the module. That branch checks neither nor the captcha result computed immediately above it, and leads to , which has no rate limit at all. ### Impact Anyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. **Honest bound.** The target must have an unconfirmed registration, that is together with an unconfirmed opt-in token. An attacker can create that state for an arbitrary address, since registration requires no ownership proof, but on a site where is off the branch is unreachable.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Packagist contao/core-bundle4.1.0 → 5.3.50
  • Packagist contao/core-bundle5.4.0-RC1 → 5.7.12

How to fix CVE-2026-107843

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-107843. EPSS is 0.26%. Act only if a listed version of Contao: The registration module is installed.

Which versions are affected?

Compare what you have installed with 4.1.0 → 5.3.50, 5.4.0-RC1 → 5.7.12. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-204; CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.26%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 9, 2026 · Catalog

    Detected

    reaches its follow-up registration branch on **any** POST to a page carrying the module. That branch checks neither nor the captcha result computed immediately above it, and leads to , which has no rate limit at all. ### Impact Anyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound messag

  2. Oct 9, 2026 · Catalog

    Fix available

    Packagist contao/core-bundle 4.1.0 → 5.3.50

  3. Oct 9, 2026 · Catalog

    Fix available

    Packagist contao/core-bundle 5.4.0-RC1 → 5.7.12

  4. Oct 9, 2026 · GitHub Advisory Database

    Fix available

    contao/core-bundle fixed in 5.3.50; contao/core-bundle fixed in 5.7.12

  5. Oct 9, 2026 · GitHub Advisory Database

    Fix available

    contao/core-bundle fixed in 5.3.50

  6. Oct 9, 2026 · GitHub Advisory Database

    Fix available

    contao/core-bundle fixed in 5.7.12

  7. Oct 9, 2026 · Catalog

    Updated

    reaches its follow-up registration branch on **any** POST to a page carrying the module. That branch checks neither nor the captcha result computed immediately above it, and leads to , which has no rate limit at all. ### Impact Anyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound messag

Sources

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.