Vulnerabilities

TI-2026-75091 CVE-2026-111358

Authorization bypass in SendPortal lets members attach subscribers to other tags

MEDIUM 57

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00319 Published 2026-10-15 No fix listed CWE-639

TI-2026-12796 CVE-2026-15192 · GHSA-qcqf-phv4-c959

mettle sendportal APIv1 Webhooks mailjet missing authentication

HIGH 70

A vulnerability has been found in mettle sendportal up to 3.0.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00763 Published 2026-07-09 No fix listed CWE-287

TI-2026-12795 CVE-2026-15191 · GHSA-274r-rpm4-6m3r

mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization

MEDIUM 57

A flaw has been found in mettle sendportal up to 3.0.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00384 Published 2026-07-09 No fix listed CWE-285

TI-2026-08972 CVE-2026-10234 · GHSA-49hc-rwwc-mfv5

Mettle sendportal Campaign webview cross site scripting

MEDIUM 56

A vulnerability was detected in Mettle sendportal up to 3.0.1.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00203 Published 2026-06-01 No fix listed CWE-79

TI-2026-06268 CVE-2026-7145 · GHSA-fvp3-crpw-3vgj

mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization

LOW 24

A weakness has been identified in mettle sendportal up to 3.0.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00235 Published 2026-04-27 No fix listed CWE-285