CVE-2026-111358

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mettle/sendportal-core
https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Http/Requests/SubscriberRequest.php#L34-L37
https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Repositories/Subscribers/BaseSubscriberTenantRepository.php#L48-L51
https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach
https://www.vulncheck.com/advisories/sendportal-sendportal-core-through-4.0.1-cross-workspace-tag-attachment-via-subscriber-form
https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach

Configurations

No configuration.

History

16 Oct 2026, 16:17

Type	Values Removed	Values Added
References	~~() https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach -~~	() https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach -

15 Oct 2026, 22:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-15 22:19

Updated : 2026-10-16 18:25

NVD link : CVE-2026-111358

Mitre link : CVE-2026-111358

CVE.ORG link : CVE-2026-111358

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-111358", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111358", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:55:17.600296Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/mettle/sendportal-core", "vendor": "mettle", "product": "sendportal-core", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.0.1"}], "packageURL": "pkg:composer/mettle/sendportal-core", "defaultStatus": "unaffected"}]}], "published": "2026-10-15T22:19:33.793", "references": [{"url": "https://github.com/mettle/sendportal-core", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Http/Requests/SubscriberRequest.php#L34-L37", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Repositories/Subscribers/BaseSubscriberTenantRepository.php#L48-L51", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/sendportal-sendportal-core-through-4.0.1-cross-workspace-tag-attachment-via-subscriber-form", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports."}], "lastModified": "2026-10-16T18:25:45.343", "sourceIdentifier": "disclosure@vulncheck.com"}