CVE-2026-111358

Received Received - Intake

Authorization Bypass in SendPortal sendportal-core

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111358

Affected Vendors & Products

Vendor	Product	Version / Range
mettle	sendportal-core	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

SendPortal sendportal-core through 4.0.1 has an authorization bypass flaw. Authenticated workspace members can attach subscribers to other workspaces' tags by providing unvalidated tag IDs. Attackers exploit this by submitting sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and manipulate victim reports.

Detection Guidance

This vulnerability involves an authorization bypass in SendPortal sendportal-core through version 4.0.1. To detect it, monitor for unusual subscriber attachments to tags across workspaces, especially involving sequential or unvalidated tag IDs. Check application logs for repeated CSV imports or web form submissions with manipulated tag IDs.

Impact Analysis

If you use SendPortal, attackers could access unauthorized campaign content, receive sensitive subscriber data, or distort reporting metrics. This could lead to data breaches, privacy violations, or incorrect business decisions based on tampered reports.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by compromising protected health information. It undermines data integrity and access controls required by these regulations, potentially leading to legal penalties and loss of compliance certifications.

Mitigation Strategies

Update sendportal-core to the latest version beyond 4.0.1 to patch the authorization bypass. Review and restrict workspace member permissions to prevent unauthorized tag attachments. Monitor subscriber lists for unexpected additions or campaign content access.

Hi! I’m here to help you understand CVE-2026-111358. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70