Answer in brief
CVE-2026-107843 records a Medium severity (CVSS 5.3) vulnerability in Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check. The current sources do not mark it as known exploited. The current feed maps contao/core-bundle (composer), contao/core-bundle (composer), contao/contao (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps contao/core-bundle (composer), contao/core-bundle (composer), contao/contao (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| contao/core-bundlecomposer | >=4.1.0,<5.3.50 | 5.3.50 |
| contao/core-bundlecomposer | >=5.4.0-RC1,<5.7.12 | 5.7.12 |
| contao/contaogeneric | >=4.1.0 <5.3.50 || >=5.4.0-RC1 <5.7.12 | 5.3.50, 5.7.12 |
Published upstream
Oct 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 9, 2026
Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to cause repeated activation emails to be sent to an address with a pending registration and to determine whether that pending registration exists. The branch is reachable only when reg_activate is enabled and the target has an unconfirmed registration and opt-in token. This issue is fixed in versions 5.3.50 and 5.7.12.
Quoted source text, attributed separately from HOL analysis.