{"uuid": "1662322c-a9f7-4b5b-b327-aaaafdec35a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107843", "type": "seen", "source": "https://gist.github.com/alon710/fea82f824d69011607c3c13f4d93e1cc", "content": "# CVE-2026-107843: CVE-2026-107843: Unthrottled Activation Email Resend and Account Enumeration in Contao CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-10-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107843\n\n## Summary\nContao CMS versions 4.1.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 fail to validate form submission tokens and enforce rate limiting when processing activation email resend requests via HTTP POST, enabling resource exhaustion and account state enumeration.\n\n## TL;DR\nUnauthenticated attackers can send repeated HTTP POST requests to Contao registration pages to trigger activation emails without captcha verification or rate limiting, causing mail flooding and unconfirmed account enumeration.\n\n## Technical Details\n\n- **CWE ID**: CWE-770, CWE-204\n- **Attack Vector**: Network (Unauthenticated HTTP POST)\n- **CVSS v3.1**: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n- **EPSS Score**: 0.00255 (15.79th percentile)\n- **Impact**: Email Flooding / Account State Enumeration\n- **Exploit Status**: Unproven / No Public Exploit\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Contao Open Source CMS versions 4.1.0 through 5.3.49\n- Contao Open Source CMS versions 5.4.0-RC1 through 5.7.11\n- **Contao Open Source CMS**: >= 4.1.0, < 5.3.50 (Fixed in: `5.3.50`)\n- **Contao Open Source CMS**: >= 5.4.0-RC1, < 5.7.12 (Fixed in: `5.7.12`)\n\n## Mitigation\n\n- Upgrade Contao CMS to version 5.3.50 or 5.7.12.\n- Implement WAF rules to rate-limit POST requests to registration endpoints.\n- Monitor application logs for high volumes of POST requests carrying the email parameter.\n\n**Remediation Steps:**\n1. Check current Contao version via composer.lock or management console.\n2. Execute `composer update contao/config-bundle contao/core-bundle` to pull version 5.3.50 or 5.7.12.\n3. Clear application cache using `vendor/bin/contao-console cache:clear`.\n4. Verify that repeated POST requests to registration forms trigger rate limit notices.\n\n## References\n\n- [GitHub Security Advisory GHSA-mfxh-vp55-7gc6](https://github.com/contao/contao/security/advisories/GHSA-mfxh-vp55-7gc6)\n- [Contao Fix Commit](https://github.com/contao/contao/commit/2ea6117f9049db7221679251cfc41e67d941a74b)\n- [Contao Release 5.3.50](https://github.com/contao/contao/releases/tag/5.3.50)\n- [Contao Release 5.7.12](https://github.com/contao/contao/releases/tag/5.7.12)\n- [NVD CVE-2026-107843 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-107843)\n- [CVE Program Record CVE-2026-107843](https://www.cve.org/CVERecord?id=CVE-2026-107843)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107843) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-10T19:30:30.000000Z"}