Insufficient Verification in Registration Module of Contao Open Source CMS
CVE-2026-107843
What is CVE-2026-107843?
The Contao Open Source CMS has a vulnerability in its registration module where the function ModuleRegistration::compile() executes a follow-up registration process during any POST request. This occurs without validating the FORM_SUBMIT token or the captcha response, potentially allowing unauthenticated attackers to reinvoke the resendActivationMail() method. As a result, they can generate multiple activation emails targeted at any pending registration, identifying whether such a registration exists. This vulnerability is present when the reg_activate feature is enabled and an unconfirmed registration along with its opt-in token is in place. The issue has been addressed in versions 5.3.50 and 5.7.12, ensuring improved security for users.
Affected Version(s)
contao >= 4.1.0, < 5.3.50 < 4.1.0, 5.3.50
contao >= 5.4.0-RC1, < 5.7.12 < 5.4.0-RC1, 5.7.12