Core bundle: Contao: The registration module re-sends activation mails (CVE-2026-107843)

The Contao core bundle's registration module (`ModuleRegistration::compile()`) improperly processes any POST request to a page containing the module by reaching a follow-up registration branch that does not verify the `FORM_SUBMIT` flag or captcha results. This leads to the `resendActivationMail()` function calling `OptInToken::send()`, which lacks any rate limiting. Consequently, an attacker can cause the site to send unlimited activation emails to arbitrary addresses. Additionally, the vulnerability allows an attacker to confirm whether an email address has a pending registration on the site, disclosing membership information that is typically expected to remain private. The vulnerability requires the target to have an unconfirmed registration state (`tl_member.disable = 1` with an unconfirmed `reg-` opt-in token), which an attacker can create since registration does not require ownership proof. The vulnerability is not exploitable if the `reg_activate` setting is off, as the vulnerable code branch is then unreachable.

An unauthenticated attacker can abuse the registration module to send unlimited activation emails from the Contao site to any email address, potentially damaging the site's email sender reputation and causing nuisance to recipients. The vulnerability also leaks membership information by confirming whether an email address has a pending registration, which may violate privacy expectations. There is no direct impact on data confidentiality or system availability beyond these effects.

A patch is available for this vulnerability and should be applied to affected Contao core bundle versions. Site operators should update to a fixed version to prevent abuse of the registration module's activation email functionality. Until patched, disabling the `reg_activate` setting can prevent the vulnerable code path from being reached. No other specific mitigations are indicated.