CVE-2026-111358

Published: Oct 15, 2026Modified: Oct 16, 2026Deferred

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (6)

https://github.com/mettle/sendportal-core

Source: disclosure@vulncheck.com

https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Http/Requests/SubscriberRequest.php#L34-L37

Source: disclosure@vulncheck.com

https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Repositories/Subscribers/BaseSubscriberTenantRepository.php#L48-L51

Source: disclosure@vulncheck.com

https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/sendportal-sendportal-core-through-4.0.1-cross-workspace-tag-attachment-via-subscriber-form

Source: disclosure@vulncheck.com

https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.