CVE-2026-107843 — Contao registration module re-sends activation mails

What happened

Contao's registration module can enter a follow-up registration branch on any POST to a page containing the registration module without checking FORM_SUBMIT or the preceding captcha. That lets resendActivationMail() invoke OptInToken::send() without rate limiting, enabling repeated activation emails to be sent to an address with a pending registration and producing an observable response difference that reveals whether such a pending registration exists.

Technical cause

ModuleRegistration::compile() does not verify FORM_SUBMIT or the prior captcha result before taking its follow-up registration branch on POST. The follow-up path leads to resendActivationMail(), which can call OptInToken::send() without any built-in rate limiting. The branch is only reachable when reg_activate is enabled and the target has an unconfirmed registration and an opt-in token.

Why it matters

An unauthenticated attacker can trigger repeated activation emails to an address that already has a pending registration and can observe responses to determine whether a pending registration exists for that address. There is no public exploit known in the sources.

Who is affected

Installations using contao/core-bundle with reg_activate enabled and with unconfirmed registrations (opt-in tokens present) are affected. The vulnerability is reachable via unauthenticated POST requests to pages that include the registration module.

Discovery and timeline

The advisory was published on 2026-10-09. The issue is recorded in OSV, the GitHub Advisory Database / Packagist advisory, and in NVD under CVE-2026-107843.

Affected versions

Packages of contao/core-bundle in the ranges >= 4.1.0 and < 5.3.50, and >= 5.4.0-RC1 and < 5.7.12 are reported as affected.

Fixes and mitigation

The issue is fixed in the vendor updates contao/core-bundle 5.3.50 and 5.7.12. Sources list those fixed versions; a patch is available.

Recommended action

Update contao/core-bundle to one of the fixed releases (5.3.50 or 5.7.12) as provided by the vendor advisory. Verify that pages exposing the registration module are covered by the update.