CVE-2026-107843

Executive Summary

CVE-2026-107843 is an observable response discrepancy vulnerability (CWE-204) in the Contao open-source CMS affecting versions 4.1.0 through 5.3.49 and 5.7.0 through 5.7.11. An unauthenticated attacker can trigger the ModuleRegistration::compile() follow-up registration branch via any POST request to a page hosting the registration module, bypassing FORM_SUBMIT validation and captcha checks, which then allows resendActivationMail() to invoke OptInToken::send() without rate limiting. The impact is limited to information disclosure (enumeration of pending registrations) and resource consumption via repeated activation emails — there is no confidentiality breach of stored data, no integrity impact, and no availability impact per the CVSS vector, resulting in a base score of 5.3.

Technical Analysis

The vulnerability resides in the registration module of the Contao CMS. The affected code path is ModuleRegistration::compile(), which contains a follow-up registration branch intended to handle form resubmission or follow-up actions. According to the NVD description, this branch is entered on any POST request to a page containing the registration module, without first verifying the FORM_SUBMIT parameter or the preceding captcha result.

This is a classic CWE-204 (Observable Response Discrepancy) issue — the application behaves differently based on internal state (whether a pending registration exists) and that difference is observable to an unauthenticated attacker. The missing FORM_SUBMIT check means the normal request-origin validation that Contao forms rely on is absent for this branch. The missing captcha verification removes the primary anti-automation control on the registration flow.

Once the branch is entered, resendActivationMail() can be invoked and will call OptInToken::send() without any rate limiting. There is no throttle on how many times this can be triggered. This produces two distinct effects:

1. Enumeration: The attacker can determine whether a pending (unconfirmed) registration exists for a given email address, because the response differs depending on the outcome of resendActivationMail().
2. Resource abuse / mail flooding: The attacker can cause repeated activation emails to be sent to an address that has a pending registration.

The NVD description explicitly states the branch is reachable only when reg_activate is enabled and the target has an unconfirmed registration and an opt-in token. This means the attack surface is conditional on the site's registration configuration (reg_activate) and on the target account being in a pending state. An account that is already confirmed, or for which no registration record exists, will not satisfy the precondition.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms: network-exploitable, low complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact only, and no integrity or availability impact as scored. The confidentiality impact (C:L) reflects the enumeration of pending registrations — the attacker learns whether a given address is in a pending state, which is a low-severity information disclosure.

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE as of the data provided. No EPSS score has been assigned by FIRST.org. The vulnerability is not listed in CISA KEV.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-204) and the mechanism described in the NVD description.

1. Reconnaissance / target identification. The attacker identifies Contao installations running an affected version (4.1.0–5.3.49 or 5.7.0–5.7.11) that have the registration module enabled with reg_activate turned on. This can be done by locating pages that contain the registration module and confirming that self-registration with activation is active. No authentication is required.

2. Triggering the flaw. The attacker sends an HTTP POST request to a page containing the registration module. Because ModuleRegistration::compile() enters the follow-up registration branch on any POST without checking FORM_SUBMIT or the captcha result, the request does not need to be a legitimate, complete registration submission. The attacker does not need to solve a captcha.

3. Payload / execution method. The attacker submits a target email address that is known or suspected to have a pending registration. The follow-up branch invokes resendActivationMail(), which calls OptInToken::send() without rate limiting. The request can be repeated arbitrarily.

4. Post-exploitation impact. Two outcomes are available to the attacker:

   • Enumeration: By observing the response difference, the attacker determines whether a pending (unconfirmed) registration exists for the submitted address. This leaks account/registration state information.
   • Mail flooding: Repeated requests cause repeated activation emails to be sent to the address with a pending registration, consuming mail resources and potentially harassing the address owner.

Because the branch requires an unconfirmed registration and opt-in token to exist, the attacker cannot leverage this to create new registrations or to confirm accounts. The impact is bounded to the two effects above and matches the C:L scoring.

Impact Assessment

The business impact of CVE-2026-107843 is low to moderate. The primary consequences are:

• Privacy / information disclosure (C:L): An unauthenticated attacker can enumerate whether specific email addresses have pending, unconfirmed registrations on a Contao site. This can support targeted phishing or account-reconnaissance campaigns but does not expose credentials or personal data directly.
• Resource consumption: Repeated triggering of OptInToken::send() without rate limiting can flood a target mailbox with activation emails and consume the site's outbound mail quota, potentially impacting mail deliverability for legitimate users. Note that the CVSS vector scores availability impact as N (none), so this is a secondary concern rather than a scored impact.
• No authentication bypass: The flaw does not allow the attacker to complete registration, confirm accounts, escalate privileges, or access protected content.

Affected systems are any Contao CMS deployments in the version ranges 4.1.0–5.3.49 and 5.7.0–5.7.11 that have registration with activation (reg_activate) enabled. Sites that disable self-registration or do not use activation opt-in are not affected. The blast radius is limited to sites with the specific configuration and is confined to the confidentiality dimension per CVSS (C:L, I:N, A:N), yielding a base score of 5.3 (Medium). No CISA KEV listing means no confirmed active exploitation in the wild at time of writing.

Detection Guidance

Sigma Rule

title: Contao Registration Module Follow-Up Branch Abuse (CVE-2026-107843)
id: 8f3c1a2e-4b7d-4c9a-9e21-6a0d5f2b7c11
status: experimental
description: Detects repeated POST requests to Contao registration pages that trigger the follow-up registration branch without FORM_SUBMIT, indicating potential enumeration or activation-mail flooding.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107843
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.reconnaissance
  - attack.t1595
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains: 'registration'
  selection_no_formsubmit:
    cs-uri-query|not_contains: 'FORM_SUBMIT'
  condition: selection_method and selection_uri and selection_no_formsubmit
  timeframe: 5m
fields:
  - c-ip
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate registration form submissions that omit FORM_SUBMIT in query string (rare)
level: medium

YARA Rule

rule CVE_2026_107843_Contao_Registration_Abuse
{
    meta:
        description = "Detects Contao registration module exploitation attempts via log/PCAP text artifacts for CVE-2026-107843"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107843"
        severity = "medium"
    strings:
        $contao = "contao" nocase
        $reg_module = "ModuleRegistration" nocase
        $resend = "resendActivationMail" nocase
        $optin = "OptInToken" nocase
        $reg_activate = "reg_activate" nocase
        $post = "POST " ascii
    condition:
        $contao and ($reg_module or $resend or $optin or $reg_activate) and $post
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107843 Contao Registration Follow-Up Branch Abuse Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"registration"; nocase; pcre:"/FORM_SUBMIT/i"; negate; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-recon; reference:cve,2026-107843; sid:2026107843; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and url.path : "*registration*" and not url.query : "*FORM_SUBMIT*"]
  [http where http.request.method == "POST" and url.path : "*registration*" and not url.query : "*FORM_SUBMIT*"]

Splunk SPL Query

index=web sourcetype=access_combined method=POST uri_path="*registration*" NOT uri_query="*FORM_SUBMIT*"
| stats count values(clientip) as src_ips values(uri_path) as paths by clientip
| where count >= 5
| table clientip, src_ips, count, paths

Wazuh OSSEC Rule

<group name="web,contao,">
  <rule id="107843" level="10">
    <if_sid>31100</if_sid>
    <match>POST</match>
    <regex>registration</regex>
    <description>CVE-2026-107843: Possible Contao registration follow-up branch abuse (repeated POST without FORM_SUBMIT)</description>
    <group>cve_2026_107843,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). The GHSA advisory states the issue is fixed in Contao versions 5.3.50 and 5.7.12. Organizations should verify these fixes against the vendor's official release channels before relying solely on this claim.

1. Immediate mitigations:

   • Disable registration activation (reg_activate) if the functionality is not operationally required. The NVD description explicitly states the vulnerable branch is only reachable when reg_activate is enabled.
   • Apply reverse-proxy or WAF rate limiting to POST requests targeting pages that contain the registration module, to blunt the mail-flooding and enumeration effects.
   • Monitor outbound activation-mail volume for anomalies.

2. Patch / upgrade steps:

   • Upgrade Contao to version 5.3.50 or 5.7.12 (or later). Confirm the release notes reference CVE-2026-107843.
   • For deployments on the 4.1.x line, confirm with the vendor whether a backport exists; the advisory only lists 5.3.50 and 5.7.12.
   • Because patch confidence is only 2/4, independently validate the fix (e.g., test that a POST without FORM_SUBMIT no longer enters the follow-up branch) after upgrading.

3. Long-term hardening:

   • Enforce FORM_SUBMIT token validation and captcha verification on all registration-related code paths, including follow-up branches.
   • Implement server-side rate limiting on any function that triggers outbound email (OptInToken::send() in this case).
   • Normalize error and response behavior on registration endpoints so that state differences (pending registration exists vs. not) are not observable to unauthenticated clients — directly addressing CWE-204.

References

• NVD — CVE-2026-107843: https://nvd.nist.gov/vuln/detail/CVE-2026-107843
• CWE-204: Observable Response Discrepancy — https://cwe.mitre.org/data/definitions/204.html
• Contao CMS Security Advisories (GHSA) — vendor-published advisory referenced as the single patch source
• Contao official releases (5.3.50 / 5.7.12) — verify at the Contao project release channel

Note: No public PoC, exploit code, or Nuclei template is available. No EPSS score has been assigned. CVE-2026-107843 is not listed in CISA KEV, and no threat actor campaign or exploit-in-the-wild evidence has been observed in the provided data.