CVE-2026-107843: Unthrottled Activation Email Resend and Account Enumeration in Contao CMS

Vulnerability ID: CVE-2026-107843
CVSS Score: 5.3
Published: 2026-10-09

Contao CMS versions 4.1.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 fail to validate form submission tokens and enforce rate limiting when processing activation email resend requests via HTTP POST, enabling resource exhaustion and account state enumeration.

TL;DR

Unauthenticated attackers can send repeated HTTP POST requests to Contao registration pages to trigger activation emails without captcha verification or rate limiting, causing mail flooding and unconfirmed account enumeration.

Technical Details

  • CWE ID: CWE-770, CWE-204
  • Attack Vector: Network (Unauthenticated HTTP POST)
  • CVSS v3.1: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
  • EPSS Score: 0.00255 (15.79th percentile)
  • Impact: Email Flooding / Account State Enumeration
  • Exploit Status: Unproven / No Public Exploit
  • CISA KEV Status: Not Listed

Affected Systems

  • Contao Open Source CMS versions 4.1.0 through 5.3.49
  • Contao Open Source CMS versions 5.4.0-RC1 through 5.7.11
  • Contao Open Source CMS: >= 4.1.0, < 5.3.50 (Fixed in: 5.3.50)
  • Contao Open Source CMS: >= 5.4.0-RC1, < 5.7.12 (Fixed in: 5.7.12)

Code Analysis

Commit: 2ea6117

Fix form submit validation and enforce rate limit on activation email resends

Mitigation Strategies

  • Upgrade Contao CMS to version 5.3.50 or 5.7.12.
  • Implement WAF rules to rate-limit POST requests to registration endpoints.
  • Monitor application logs for high volumes of POST requests carrying the email parameter.

Remediation Steps:

  1. Check current Contao version via composer.lock or management console.
  2. Execute composer update contao/config-bundle contao/core-bundle to pull version 5.3.50 or 5.7.12.
  3. Clear application cache using vendor/bin/contao-console cache:clear.
  4. Verify that repeated POST requests to registration forms trigger rate limit notices.

References

Read the full report for CVE-2026-107843 on our website for more details including interactive diagrams and full exploit analysis.