Presentation
Contao can require new front end members to confirm their address before the account becomes active, and offers a way to resend that activation email.
HDW Sec found that the resend action is neither rate-limited nor uniform in its responses, which turns it into both an email flooding primitive and a registration oracle.
Issue(s)
- The resend endpoint can be called repeatedly for the same address with no throttling, so an unauthenticated attacker can have the site send an unbounded number of emails to a third party.
- The site’s own domain is the sender, so the abuse is attributed to the site and can affect its sending reputation.
- The behaviour differs depending on whether the address is registered, which lets an attacker enumerate which addresses hold an account on the site.
- No authentication is required at any point.
References
- GitHub advisory: GHSA-mfxh-vp55-7gc6
- Fixed in Contao 5.3.50 and 5.7.12, published 2026-08-25. No CVE assigned as of publication.