GHSA-mfxh-vp55-7gc6: Medium severity composer/contao/core-bundle vulnerability

Q: Which Contao sites are exposed to the mail-sending and account-enumeration behavior?

A site is exposed when registration activation is enabled (`reg_activate`) and a target address has an unconfirmed registration: a disabled `tl_member` record with an unconfirmed `reg-` opt-in token. If `reg_activate` is off, the affected branch is unreachable.

Q: What does an attacker need to exploit this?

No authentication, CAPTCHA completion, or valid form submission is required. Any internet user can send POST requests to a page carrying the registration module; they can also create an unconfirmed registration state for an arbitrary address because registration does not require ownership proof.

Q: What can be done if the update cannot be applied immediately?

Disable registration activation (`reg_activate`) to make the affected branch unreachable. This may affect the site's registration workflow, so it should be evaluated as a temporary mitigation.

Q: How can operators identify potentially affected accounts or abuse?

Look for members with `tl_member.disable = 1` and an unconfirmed `reg-` opt-in token, as these are the accounts that can be targeted. Review web request and mail-sending activity for repeated POSTs to pages containing the registration module and repeated activation emails.

Published Oct 9, 2026

Updated

ModuleRegistration::compile() reaches its follow-up registration branch on any POST to a page carrying the module. That branch checks neither FORMSUBMIT nor the captcha result computed immediately above it, and resendActivationMail() leads to OptInToken::send(), which has no rate limit at all.

Impact

Anyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose.

Honest bound. The target must have an unconfirmed registration, that is tlmember.disable = 1 together with an unconfirmed reg- opt-in token. An attacker can create that state for an arbitrary address, since registration requires no ownership proof, but on a site where regactivate is off the branch is unreachable.

Affected Software

2 affected componentsFixes available

composer/contao/core-bundle>=5.4.0-RC1<5.7.12

5.7.12

composer/contao/core-bundle>=4.1.0<5.3.50

5.3.50

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/contao/core-bundle to a version that resolves this vulnerability.
Fixed in 5.7.12
Upgrade
Upgrade composer/contao/core-bundle to a version that resolves this vulnerability.
Fixed in 5.3.50

Event History

Oct 9, 2026

Advisory Published

via GitHub·08:54 PM

Data Sourced

via GitHub·08:54 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which Contao sites are exposed to the mail-sending and account-enumeration behavior?

A site is exposed when registration activation is enabled (`reg_activate`) and a target address has an unconfirmed registration: a disabled `tl_member` record with an unconfirmed `reg-` opt-in token. If `reg_activate` is off, the affected branch is unreachable.

What does an attacker need to exploit this?

No authentication, CAPTCHA completion, or valid form submission is required. Any internet user can send POST requests to a page carrying the registration module; they can also create an unconfirmed registration state for an arbitrary address because registration does not require ownership proof.

What can be done if the update cannot be applied immediately?

Disable registration activation (`reg_activate`) to make the affected branch unreachable. This may affect the site's registration workflow, so it should be evaluated as a temporary mitigation.

How can operators identify potentially affected accounts or abuse?

Look for members with `tl_member.disable = 1` and an unconfirmed `reg-` opt-in token, as these are the accounts that can be targeted. Review web request and mail-sending activity for repeated POSTs to pages containing the registration module and repeated activation emails.

GHSA-mfxh-vp55-7gc6: Medium severity composer/contao/core-bundle vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Contao sites are exposed to the mail-sending and account-enumeration behavior?

What does an attacker need to exploit this?

What can be done if the update cannot be applied immediately?

How can operators identify potentially affected accounts or abuse?

Company

Resources

Contact

Frequently Asked Questions

Which Contao sites are exposed to the mail-sending and account-enumeration behavior?

What does an attacker need to exploit this?

What can be done if the update cannot be applied immediately?

How can operators identify potentially affected accounts or abuse?