Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/CVE-2026-107843.md

Created October 10, 2026 19:30
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/fea82f824d69011607c3c13f4d93e1cc to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/fea82f824d69011607c3c13f4d93e1cc to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2026-107843: CVE-2026-107843: Unthrottled Activation Email Resend and Account Enumeration in Contao CMS - CVE Security Report
Raw
CVE-2026-107843.md

CVE-2026-107843: CVE-2026-107843: Unthrottled Activation Email Resend and Account Enumeration in Contao CMS

CVSS Score: 5.3 Published: 2026-10-09 Full Report: https://cvereports.com/reports/CVE-2026-107843

Summary

Contao CMS versions 4.1.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 fail to validate form submission tokens and enforce rate limiting when processing activation email resend requests via HTTP POST, enabling resource exhaustion and account state enumeration.

TL;DR

Unauthenticated attackers can send repeated HTTP POST requests to Contao registration pages to trigger activation emails without captcha verification or rate limiting, causing mail flooding and unconfirmed account enumeration.

Technical Details

  • CWE ID: CWE-770, CWE-204
  • Attack Vector: Network (Unauthenticated HTTP POST)
  • CVSS v3.1: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
  • EPSS Score: 0.00255 (15.79th percentile)
  • Impact: Email Flooding / Account State Enumeration
  • Exploit Status: Unproven / No Public Exploit
  • CISA KEV Status: Not Listed

Affected Systems

  • Contao Open Source CMS versions 4.1.0 through 5.3.49
  • Contao Open Source CMS versions 5.4.0-RC1 through 5.7.11
  • Contao Open Source CMS: >= 4.1.0, < 5.3.50 (Fixed in: 5.3.50)
  • Contao Open Source CMS: >= 5.4.0-RC1, < 5.7.12 (Fixed in: 5.7.12)

Mitigation

  • Upgrade Contao CMS to version 5.3.50 or 5.7.12.
  • Implement WAF rules to rate-limit POST requests to registration endpoints.
  • Monitor application logs for high volumes of POST requests carrying the email parameter.

Remediation Steps:

  1. Check current Contao version via composer.lock or management console.
  2. Execute composer update contao/config-bundle contao/core-bundle to pull version 5.3.50 or 5.7.12.
  3. Clear application cache using vendor/bin/contao-console cache:clear.
  4. Verify that repeated POST requests to registration forms trigger rate limit notices.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment