CVE-2026-107843: Contao CMS Information Disclosure Flaw

CVE-2026-107843 Overview

Contao, an open-source content management system (CMS), contains a logic flaw in the ModuleRegistration::compile() method. The vulnerability affects versions from 4.1.0 up to the fixes in 5.3.50 and 5.7.12. The method enters its follow-up registration branch on any POST request to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha result. This allows an unauthenticated attacker to invoke resendActivationMail() repeatedly against addresses with pending registrations. The flaw enables email bombing and account enumeration of pending registrations [CWE-204].

Critical Impact

Unauthenticated attackers can trigger unlimited activation emails to a victim address and confirm whether a pending registration exists for that email.

Affected Products

• Contao CMS versions 4.1.0 through 5.3.49
• Contao CMS versions 5.4.0 through 5.7.11
• Instances where reg_activate is enabled with pending unconfirmed registrations

Discovery Timeline

• 2026-10-09 - CVE CVE-2026-107843 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-107843

Vulnerability Analysis

The vulnerability resides in the ModuleRegistration::compile() method within the Contao core-bundle. The follow-up registration branch executes on any POST request containing an email parameter when reg_activate is enabled. The branch calls MemberModel::findUnactivatedByEmail() and, on a match, invokes resendActivationMail(), which calls OptInToken::send().

Two security controls are missing on this code path. The handler does not verify the FORM_SUBMIT token that normally confirms a legitimate form submission from the registration form. The captcha result preceding the registration form is also not validated. No rate limiting is applied to repeated submissions, so an attacker can script requests at arbitrary volume.

Root Cause

The root cause is improper input validation on the follow-up registration code path combined with missing rate limiting on OptInToken::send(). Because the branch processes POST data before confirming the submission originated from the actual form, attackers bypass both anti-automation controls (FORM_SUBMIT, captcha) and resource-protection controls.

Attack Vector

An unauthenticated attacker sends crafted POST requests to any page hosting the registration module, supplying a target email address. If a pending unconfirmed registration exists for that address, the server issues a new activation email through OptInToken::send(). Response differentials or email delivery observation allow the attacker to enumerate addresses with pending registrations. Repeated requests flood the victim mailbox and the Contao mail queue.

		$objMember = null;

		// Check for a follow-up registration (see #7992)
-		if ($this->reg_activate && Input::post('email', true) && ($objMember = MemberModel::findUnactivatedByEmail(Input::post('email', true))) !== null)
+		if (!$doNotSubmit && Input::post('FORM_SUBMIT') == $strFormId && $this->reg_activate && Input::post('email', true) && ($objMember = MemberModel::findUnactivatedByEmail(Input::post('email', true))) !== null)
 		{
 			$this->resendActivationMail($objMember);

Source: GitHub Commit 2ea6117f. The patch adds !$doNotSubmit and FORM_SUBMIT token verification before entering the branch.

Detection Methods for CVE-2026-107843

Indicators of Compromise

• High volume of POST requests to pages containing the registration module from a single source IP or small IP set
• Repeated POSTs with varying email parameters but missing or stale FORM_SUBMIT tokens
• Spikes in outbound activation emails from the Contao mail queue to the same recipient address
• User complaints about repeated unsolicited Contao activation emails

Detection Strategies

• Review web server access logs for POST requests to registration-module URLs lacking a prior GET fetch of the form within a plausible user session window
• Correlate POST request bursts with outbound SMTP activity from the Contao application
• Alert on repeated OptInToken generation events for the same member record within short time windows

Monitoring Recommendations

• Monitor application logs for repeated resendActivationMail invocations against the same email address
• Track mail queue depth and bounce rates to detect email-bombing patterns
• Deploy web application firewall (WAF) rules to flag POSTs missing a valid FORM_SUBMIT token on registration endpoints

How to Mitigate CVE-2026-107843

Immediate Actions Required

• Upgrade Contao to version 5.3.50 or 5.7.12 as soon as possible
• Audit outbound mail logs for signs of activation-email abuse against your user base
• Temporarily disable reg_activate on affected pages if patching cannot be scheduled immediately

Patch Information

Contao maintainers released fixes in GitHub Release 5.3.50 and GitHub Release 5.7.12. The fix in GitHub Commit 2ea6117f adds FORM_SUBMIT verification and introduces a rate-limit message (MSC.tooManyResendActivationAttempts) covering 15-minute lockout windows. Full details are available in GitHub Security Advisory GHSA-mfxh-vp55-7gc6.

Workarounds

• Place the registration page behind an upstream rate limiter restricting POST requests per source IP
• Enforce WAF rules that reject POSTs to registration pages missing the expected FORM_SUBMIT field value
• Remove or hide the registration module on public pages until the upgrade is applied

# Upgrade Contao via Composer to the patched release
composer require contao/core-bundle:^5.3.50
# or for the 5.7 branch
composer require contao/core-bundle:^5.7.12
composer update contao/*