Authentication Bypass in Mettle SendPortal APIv1 Webhooks

Executive Summary

CVE-2026-15192 is a security vulnerability in the mettle sendportal software up to version 3.0.1. It affects the APIv1 Webhooks component, specifically the functions handling webhooks from email providers such as SendGrid, Postmark, Postal, and Mailjet.

The vulnerability arises because the webhook handlers do not verify the authenticity of incoming webhook events. This missing authentication allows unauthenticated attackers to forge webhook events by submitting fake bounce notifications using a valid message ID.

As a result, attackers can manipulate subscriber status by marking subscribers as unsubscribed without proper verification, which disrupts normal email campaign delivery.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to remotely submit forged webhook events that falsely mark subscribers as unsubscribed.

Consequently, legitimate subscribers may be prevented from receiving future email campaigns, which can degrade communication effectiveness and harm marketing efforts.

Since the attack can be carried out remotely without authentication, it poses a significant risk to the integrity of subscriber management and email delivery.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized or suspicious webhook events targeting the SendGrid, Postmark, Postal, or Mailjet webhook endpoints of the SendPortal APIv1 Webhooks component.

Specifically, detection involves checking for webhook requests that lack proper signature verification headers, such as SendGrid's X-Twilio-Email-Event-Webhook-Signature header, or other provider-specific authenticity mechanisms.

Commands to help detect such activity could include inspecting web server logs or using network monitoring tools to filter HTTP POST requests to the webhook endpoints and verify the presence or absence of expected signature headers.

• Use grep or similar tools to search web server logs for POST requests to webhook URLs missing signature headers, e.g., `grep 'POST /api/v1/webhooks/sendgrid' /var/log/nginx/access.log | grep -v 'X-Twilio-Email-Event-Webhook-Signature'`
• Use packet capture tools like tcpdump or Wireshark to filter HTTP POST requests to webhook endpoints and analyze headers for missing authentication signatures.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to implement provider-specific webhook authenticity verification before processing any incoming webhook payloads.

This means validating signatures or other authenticity headers provided by email providers such as SendGrid's X-Twilio-Email-Event-Webhook-Signature header to ensure that webhook events are legitimate.

Until an official patch or update is released, you should consider blocking or filtering webhook requests that do not contain valid authentication signatures to prevent unauthorized state modifications.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to forge webhook events, leading to unauthorized modification of subscriber states, such as marking subscribers as unsubscribed.

This unauthorized state modification could impact compliance with regulations like GDPR and HIPAA, which require proper protection of personal data and user consent management.

Specifically, the ability to manipulate subscription status without verification may violate requirements for data integrity and user consent under these standards.

However, the provided information does not explicitly detail compliance impacts or regulatory assessments.

Useful 0 Not Useful 0