CVE-2026-111358CWE-639

CVE-2026-111358

Medium · published October 16, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00260 · 16.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-16T02:19Z
References (6)
https://github.com/mettle/sendportal-core · [email protected]https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Http/Requests/SubscriberRequest.php#L34-L37 · [email protected]https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Repositories/Subscribers/BaseSubscriberTenantRepository.php#L48-L51 · [email protected]https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach · [email protected]https://www.vulncheck.com/advisories/sendportal-sendportal-core-through-4.0.1-cross-workspace-tag-attachment-via-subscriber-form · [email protected]https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 15 OCT 21:43Z
    SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form
    cvelistv5
  • 15 OCT 21:43Z
    SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form
    cvelistv5