CVE-2026-107843

Name of the Vulnerable Software and Affected Versions Contao versions 4.1.0 through 5.3.49 Contao versions 5.7.0 through 5.7.11

Description An issue exists where the ModuleRegistration::compile() function enters its follow-up registration branch on any POST request to a page containing the registration module without verifying FORM SUBMIT or the preceding captcha result. This allows an unauthenticated attacker to trigger the resendActivationMail() function, which invokes OptInToken::send() without rate limiting. Consequently, an attacker can cause repeated activation emails to be sent to an address with a pending registration and determine if such a registration exists. This behavior occurs when reg activate is enabled and the target has an unconfirmed registration and opt-in token. This can lead to a deliverability risk for the site operator and the disclosure of membership status.

Recommendations Update to version 5.3.50. Update to version 5.7.12.