CVE-2026-15191: Mettle SendPortal Authorization Bypass in Campaign Creation Endpoint

Technical summary

CVE-2026-15191 is an authorization bypass vulnerability in the Campaign Creation Endpoint of Mettle SendPortal (vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php). The vulnerability stems from insufficient authorization checks (CWE-285: Improper Authorization, CWE-639: Authorization Bypass Through User-Controlled Key) in the request handler responsible for campaign creation. An authenticated attacker can manipulate request parameters to bypass access controls, gaining the ability to execute unauthorized operations on the SendPortal platform. The CVSS 3.1 score of 6.3 (MEDIUM) reflects low-to-medium impact across confidentiality, integrity, and availability with network accessibility and low privilege requirement.

Business impact

Organizations running affected SendPortal instances face the risk of unauthorized campaign access and modification by legitimate platform users. An attacker with standard user privileges could potentially view, create, or alter campaigns belonging to other users or administrators, leading to data exposure, campaign tampering, or operational disruption. In multi-tenant or agency environments where SendPortal manages client campaigns, the impact escalates—compromised user accounts could affect multiple downstream customers. Additionally, since a public exploit exists, this vulnerability is more likely to be targeted opportunistically.

Affected systems

Mettle SendPortal versions up to and including 3.0.1 are affected. Organizations should verify their current SendPortal version against the latest release notes. The vulnerability does not appear to affect other Mettle products based on available information, but administrators should confirm their deployment scope. This vulnerability requires an authenticated user account to exploit—it does not affect unauthenticated access.

Exploitability

The vulnerability is remotely exploitable and requires only low-privilege user authentication (PR:L in the CVSS vector). The attack complexity is low, meaning standard exploitation techniques are likely effective. Notably, a public proof-of-concept has been published, significantly increasing the practical risk of exploitation. Threat actors do not need sophisticated tooling; attackers with compromised or insider user accounts can trivially leverage this flaw. The lack of CISA KEV designation does not diminish the urgency, particularly given public exploit availability.

Remediation

Affected organizations must upgrade to a patched version of SendPortal released by Mettle. Verify against the official Mettle SendPortal advisory for the specific version that remediates this vulnerability. Until patches are available, organizations should implement compensating controls: restrict SendPortal access to trusted networks via firewall or VPN, audit user account creation and privilege assignments, monitor campaign creation and modification logs for unauthorized activity, and restrict admin account usage to principle of least privilege. Consider temporarily disabling campaign creation for non-administrative users if the risk is acute.

Patch guidance

Upgrade SendPortal to the latest patched version provided by Mettle. Visit the official Mettle SendPortal releases page or security advisory for detailed upgrade instructions and version availability. Organizations should test patches in a non-production environment first. If a patched version is not yet available, continue implementing the compensating controls listed above. Monitor the Mettle project's issue tracker and security channels for patch release notifications.

Detection guidance

Monitor SendPortal logs for authorization failures and unexpected campaign creation or modification events, particularly those initiated by non-administrative users. Examine HTTP request logs for unusual POST/PUT requests to the /campaigns endpoint with tampered or elevated permission parameters. Alert on rapid campaign creation by single users or patterns inconsistent with normal operations. If available, enable verbose API logging to capture request payloads. Review user account login patterns for suspicious access timing or geography that may indicate compromised credentials being leveraged for exploitation.

Why prioritize this

This vulnerability merits prompt attention despite MEDIUM severity. The combination of public exploit availability, low attack complexity, low privilege requirement, and authenticated remote exploitability creates a meaningful operational risk. Multi-user or multi-tenant SendPortal deployments face elevated exposure. Organizations should prioritize patching but may sequence based on user base sensitivity and network segmentation—those with restricted internal use may defer slightly longer than those with exposed SendPortal instances.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a MEDIUM severity rating. The network vector (AV:N) and low attack complexity (AC:L) indicate the flaw is easily reachable and exploitable. The low privilege requirement (PR:L) means standard users can trigger the vulnerability. The impact is balanced across confidentiality, integrity, and availability (C:L/I:L/A:L), each contributing equally but not catastrophically. The scope is unchanged (S:U), so the vulnerability does not cascade to other systems. The score aligns with the practical threat: opportunistic but not critical without additional context.

Frequently asked questions