All vulnerabilities
CVE-2026-107843GHSA-mfxh-vp55-7gc6

contao/core-bundle: Contao: The registration module re-sends activation mails

contao contao/core-bundlecomposerLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.3.50Also 5.7.12GitHub
Published9 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

  • 5.3.50contao/core-bundle, composerGitHubcomposer require "contao/core-bundle:^5.3.50"
  • 5.7.12contao/core-bundle, composerGitHubcomposer require "contao/core-bundle:^5.7.12"
  • 5.3.50contao/core-bundle, PackagistOSVcomposer require "contao/core-bundle:^5.3.50"
  • 5.7.12contao/core-bundle, PackagistOSVcomposer require "contao/core-bundle:^5.7.12"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

ModuleRegistration::compile() reaches its follow-up registration branch on any POST to a page carrying the module. That branch checks neither FORM_SUBMIT nor the captcha result computed immediately above it, and resendActivationMail() leads to OptInToken::send(), which has no rate limit at all.

Impact

Anyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose.

Honest bound. The target must have an unconfirmed registration, that is tl_member.disable = 1 together with an unconfirmed reg- opt-in token. An attacker can create that state for an arbitrary address, since registration requires no ownership proof, but on a site where reg_activate is off the branch is unreachable.

Text from GitHub Advisory Database

Affected versions 106

  • contao/core-bundle, composer>= 4.1.0, < 5.3.50GitHub
  • contao/core-bundle, composer>= 5.4.0-RC1, < 5.7.12GitHub
  • contaoaffected: >= 4.1.0, < 5.3.50CVE List
  • contaoaffected: >= 5.4.0-RC1, < 5.7.12CVE List
  • contao/core-bundle, Packagistfrom 4.1.0, fixed in 5.3.50OSV
  • contao/core-bundle, Packagist4.1.0OSV
  • contao/core-bundle, Packagist4.1.1OSV
  • contao/core-bundle, Packagist4.1.2OSV
  • contao/core-bundle, Packagist4.1.3OSV
  • contao/core-bundle, Packagist4.10.0OSV
  • contao/core-bundle, Packagist4.10.0-RC1OSV
  • contao/core-bundle, Packagist4.10.0-RC2OSV
  • contao/core-bundle, Packagist4.10.0-RC3OSV
  • contao/core-bundle, Packagist4.10.0-RC4OSV
  • contao/core-bundle, Packagist4.10.1OSV
  • contao/core-bundle, Packagist4.10.2OSV
  • contao/core-bundle, Packagist4.10.3OSV
  • contao/core-bundle, Packagist4.10.4OSV
  • contao/core-bundle, Packagist4.10.5OSV
  • contao/core-bundle, Packagist4.10.6OSV
  • contao/core-bundle, Packagist4.10.7OSV
  • contao/core-bundle, Packagist4.11.0OSV
  • contao/core-bundle, Packagist4.11.0-RC1OSV
  • contao/core-bundle, Packagist4.11.0-RC2OSV
  • contao/core-bundle, Packagist4.11.1OSV
  • contao/core-bundle, Packagist4.11.2OSV
  • contao/core-bundle, Packagist4.11.3OSV
  • contao/core-bundle, Packagist4.11.4OSV
  • contao/core-bundle, Packagist4.11.5OSV
  • contao/core-bundle, Packagist4.11.6OSV
  • contao/core-bundle, Packagist4.11.7OSV
  • contao/core-bundle, Packagist4.11.8OSV
  • contao/core-bundle, Packagist4.11.9OSV
  • contao/core-bundle, Packagist4.12.0OSV
  • contao/core-bundle, Packagist4.12.0-RC1OSV
  • contao/core-bundle, Packagist4.12.0-RC2OSV
  • contao/core-bundle, Packagist4.12.0-RC3OSV
  • contao/core-bundle, Packagist4.12.1OSV
  • contao/core-bundle, Packagist4.12.2OSV
  • contao/core-bundle, Packagist4.12.3OSV
  • contao/core-bundle, Packagist4.12.4OSV
  • contao/core-bundle, Packagist4.12.5OSV
  • contao/core-bundle, Packagist4.12.6OSV
  • contao/core-bundle, Packagist4.12.7OSV
  • contao/core-bundle, Packagist4.13.0OSV
  • contao/core-bundle, Packagist4.13.0-RC1OSV
  • contao/core-bundle, Packagist4.13.0-RC2OSV
  • contao/core-bundle, Packagist4.13.0-RC3OSV
  • contao/core-bundle, Packagist4.13.1OSV
  • contao/core-bundle, Packagist4.13.10OSV
  • contao/core-bundle, Packagist4.13.11OSV
  • contao/core-bundle, Packagist4.13.12OSV
  • contao/core-bundle, Packagist4.13.13OSV
  • contao/core-bundle, Packagist4.13.14OSV
  • contao/core-bundle, Packagist4.13.15OSV
  • contao/core-bundle, Packagistfrom 5.4.0-RC1, fixed in 5.7.12OSV
  • contao/core-bundle, Packagist5.4.0OSV
  • contao/core-bundle, Packagist5.4.0-RC1OSV
  • contao/core-bundle, Packagist5.4.0-RC2OSV
  • contao/core-bundle, Packagist5.4.0-RC3OSV
  • contao/core-bundle, Packagist5.4.0-RC4OSV
  • contao/core-bundle, Packagist5.4.1OSV
  • contao/core-bundle, Packagist5.4.10OSV
  • contao/core-bundle, Packagist5.4.11OSV
  • contao/core-bundle, Packagist5.4.12OSV
  • contao/core-bundle, Packagist5.4.13OSV
  • contao/core-bundle, Packagist5.4.14OSV
  • contao/core-bundle, Packagist5.4.2OSV
  • contao/core-bundle, Packagist5.4.3OSV
  • contao/core-bundle, Packagist5.4.4OSV
  • contao/core-bundle, Packagist5.4.5OSV
  • contao/core-bundle, Packagist5.4.6OSV
  • contao/core-bundle, Packagist5.4.7OSV
  • contao/core-bundle, Packagist5.4.8OSV
  • contao/core-bundle, Packagist5.4.9OSV
  • contao/core-bundle, Packagist5.5.0OSV
  • contao/core-bundle, Packagist5.5.0-RC1OSV
  • contao/core-bundle, Packagist5.5.0-RC2OSV
  • contao/core-bundle, Packagist5.5.0-RC3OSV
  • contao/core-bundle, Packagist5.5.0-RC4OSV
  • contao/core-bundle, Packagist5.5.1OSV
  • contao/core-bundle, Packagist5.5.10OSV
  • contao/core-bundle, Packagist5.5.11OSV
  • contao/core-bundle, Packagist5.5.12OSV
  • contao/core-bundle, Packagist5.5.13OSV
  • contao/core-bundle, Packagist5.5.14OSV
  • contao/core-bundle, Packagist5.5.15OSV
  • contao/core-bundle, Packagist5.5.16OSV
  • contao/core-bundle, Packagist5.5.2OSV
  • contao/core-bundle, Packagist5.5.3OSV
  • contao/core-bundle, Packagist5.5.4OSV
  • contao/core-bundle, Packagist5.5.5OSV
  • contao/core-bundle, Packagist5.5.6OSV
  • contao/core-bundle, Packagist5.5.7OSV
  • contao/core-bundle, Packagist5.5.8OSV
  • contao/core-bundle, Packagist5.5.9OSV
  • contao/core-bundle, Packagist5.6.0OSV
  • contao/core-bundle, Packagist5.6.0-RC1OSV
  • contao/core-bundle, Packagist5.6.0-RC2OSV
  • contao/core-bundle, Packagist5.6.0-RC3OSV
  • contao/core-bundle, Packagist5.6.1OSV
  • contao/core-bundle, Packagist5.6.10OSV
  • contao/core-bundle, Packagist5.6.11OSV
  • contao/core-bundle, Packagist5.6.2OSV
  • contao/core-bundle, Packagist5.6.3OSV
  • contao/core-bundle, Packagist5.6.4OSV

References 5