{"metadata": {"vulnerability": "CVE-2026-107843", "count": 13, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-10-08T22:34:49.291Z", "date_only": false, "value": "2026-10-08T22:34:49.291Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-107843", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-09T19:21:32.011Z", "date_only": false, "value": "2026-10-09T19:21:32.011Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-107843", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-09T19:21:32.011Z", "date_only": false, "value": "2026-10-09T19:21:32.011Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-107843", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-09T19:30:53.867Z", "date_only": false, "value": "2026-10-09T19:30:53.867228Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117412610258144245", "record": "CVE-2026-107843", "field": "creation_timestamp", "uuid": "795036fc-ed10-4e45-a3ad-684632accaff", "content": "CVE-2026-107843 Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to cause repeated activation emails to be sent to an address with a pending registration and to determine whether that pending registration exists. The branch is reachable only when reg_activate is enabled and the target has an unconfirmed registration and opt-in token. This issue is fixed in versions 5.3.50 and 5.7.12.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107843https://github.com/contao/contao/security/advisories/GHSA-mfxh-vp55-7gc6https://github.com/contao/contao/commit/2ea6117f9049db7221679251cfc41e67d941a74bhttps://github.com/contao/contao/releases/tag/5.3.50https://github.com/contao/contao/releases/tag/5.7.12#contao#CVE_2026_107843#bot", "url": "https://infosec.exchange/users/cve/statuses/117412610258144245"}, {"timestamp": "2026-10-09T20:17:10.167Z", "date_only": false, "value": "2026-10-09T20:17:10.167", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107843", "record": "FKIE_CVE-2026-107843", "field": "published"}, {"timestamp": "2026-10-09T20:54:04Z", "date_only": false, "value": "2026-10-09T20:54:04Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MFXH-VP55-7GC6", "record": "GHSA-MFXH-VP55-7GC6", "field": "published"}, {"timestamp": "2026-10-09T20:54:04Z", "date_only": false, "value": "2026-10-09T20:54:04Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MFXH-VP55-7GC6", "record": "GHSA-MFXH-VP55-7GC6", "field": "modified"}, {"timestamp": "2026-10-10T19:30:30Z", "date_only": false, "value": "2026-10-10T19:30:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/fea82f824d69011607c3c13f4d93e1cc", "record": "CVE-2026-107843", "field": "creation_timestamp", "uuid": "1662322c-a9f7-4b5b-b327-aaaafdec35a1", "content": "# CVE-2026-107843: CVE-2026-107843: Unthrottled Activation Email Resend and Account Enumeration in Contao CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-10-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107843\n\n## Summary\nContao CMS versions 4.1.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 fail to validate form submission tokens and enforce rate limiting when processing activation email resend requests via HTTP POST, enabling resource exhaustion and account state enumeration.\n\n## TL;DR\nUnauthenticated attackers can send repeated HTTP POST requests to Contao registration pages to trigger activation emails without captcha verification or rate limiting, causing mail flooding and unconfirmed account enumeration.\n\n## Technical Details\n\n- **CWE ID**: CWE-770, CWE-204\n- **Attack Vector**: Network (Unauthenticated HTTP POST)\n- **CVSS v3.1**: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n- **EPSS Score**: 0.00255 (15.79th percentile)\n- **Impact**: Email Flooding / Account State Enumeration\n- **Exploit Status**: Unproven / No Public Exploit\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Contao Open Source CMS versions 4.1.0 through 5.3.49\n- Contao Open Source CMS versions 5.4.0-RC1 through 5.7.11\n- **Contao Open Source CMS**: >= 4.1.0, < 5.3.50 (Fixed in: `5.3.50`)\n- **Contao Open Source CMS**: >= 5.4.0-RC1, < 5.7.12 (Fixed in: `5.7.12`)\n\n## Mitigation\n\n- Upgrade Contao CMS to version 5.3.50 or 5.7.12.\n- Implement WAF rules to rate-limit POST requests to registration endpoints.\n- Monitor application logs for high volumes of POST requests carrying the email parameter.\n\n**Remediation Steps:**\n1. Check current Contao version via composer.lock or management console.\n2. Execute `composer update contao/config-bundle contao/core-bundle` to pull version 5.3.50 or 5.7.12.\n3. Clear application cache using `vendor/bin/contao-console cache:clear`.\n4. Verify that repeated POST requests to registration forms trigger rate limit notices.\n\n## References\n\n- [GitHub Security Advisory GHSA-mfxh-vp55-7gc6](https://github.com/contao/contao/security/advisories/GHSA-mfxh-vp55-7gc6)\n- [Contao Fix Commit](https://github.com/contao/contao/commit/2ea6117f9049db7221679251cfc41e67d941a74b)\n- [Contao Release 5.3.50](https://github.com/contao/contao/releases/tag/5.3.50)\n- [Contao Release 5.7.12](https://github.com/contao/contao/releases/tag/5.7.12)\n- [NVD CVE-2026-107843 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-107843)\n- [CVE Program Record CVE-2026-107843](https://www.cve.org/CVERecord?id=CVE-2026-107843)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107843) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/fea82f824d69011607c3c13f4d93e1cc"}, {"timestamp": "2026-10-13T17:08:09.326Z", "date_only": false, "value": "2026-10-13T17:08:09.326334Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-107843", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T17:08:09.326Z", "date_only": false, "value": "2026-10-13T17:08:09.326334Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107843", "record": "FKIE_CVE-2026-107843", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T17:08:23.664Z", "date_only": false, "value": "2026-10-13T17:08:23.664Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-107843", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T17:08:23.664Z", "date_only": false, "value": "2026-10-13T17:08:23.664Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-107843", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T18:17:16.130Z", "date_only": false, "value": "2026-10-13T18:17:16.130", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107843", "record": "FKIE_CVE-2026-107843", "field": "lastModified"}]}