CVE-2026-15192: Missing Authentication in Mettle Sendportal APIv1 Webhooks

Technical summary

CVE-2026-15192 is an authentication bypass in Sendportal's APIv1 webhook implementation. The affected webhook endpoints for third-party email service providers fail to enforce proper authentication controls before processing webhook callbacks. This violates CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function). An attacker without credentials can submit crafted webhook requests to manipulate email delivery tracking, bounce handling, or other transactional email workflows. The attack requires only network access and no user interaction.

Business impact

Email delivery pipelines relying on Sendportal webhooks are exposed to tampering. An attacker could forge webhook events to indicate false delivery statuses, suppress bounce notifications, or disrupt email routing logic. For organizations using Sendportal for transactional communications (password resets, notifications, alerts), this could result in lost or misdirected messages, operational blind spots, and degraded user trust. The integrity impact—rather than confidentiality—makes this a data manipulation risk rather than an exposure risk.

Affected systems

Mettle Sendportal versions up to 3.0.1 are vulnerable. The APIv1 webhook handlers for Sendgrid, Postmark, Postal, and Mailjet integrations are the attack surface. Organizations running Sendportal in production as their email service backbone should inventory their deployment version immediately. No vendor patch status is confirmed at this time.

Exploitability

Exploitability is high: the attack vector is network-based, requires no privileges or user interaction, and attack complexity is low. Public exploit disclosure has occurred. An attacker can craft and send malicious webhook payloads without authentication barriers. This is not a theoretical risk—the vulnerability has moved beyond responsible disclosure.

Remediation

Immediately audit your Sendportal deployment version. If running 3.0.1 or earlier, contact Mettle for patch availability or consider implementing network-level controls to restrict webhook endpoint access to known email provider IP ranges. Implement request signing or IP whitelisting at the reverse proxy or firewall level as a compensating control. Monitor webhook logs for anomalous or unsigned requests. Do not rely on the application alone until a patch is applied.

Patch guidance

Verify the latest stable release of Mettle Sendportal against the official vendor repository. The vendor has been notified but has not yet provided a patched version as of the disclosure date (2026-07-09). Check Mettle's issue tracker and release notes for updates. If a patch is released, apply it to all Sendportal instances before re-exposing webhook endpoints to the internet. Test webhook functionality with your email providers after patching.

Detection guidance

Monitor APIv1 webhook endpoints (/webhooks or similar paths) for unauthenticated requests or requests missing expected authentication headers or signatures. Log and alert on webhook requests from unexpected source IPs or with malformed payloads. Examine webhook logs for event timestamps or payloads that do not correspond to actual email send operations. Correlate webhook event records with actual email provider logs to detect forged or out-of-sequence callbacks. Implement request logging at the proxy level if application logging is insufficient.

Why prioritize this

Despite a CVSS score of 6.5 (Medium), this vulnerability warrants priority attention because: (1) public exploits are available, (2) the attack surface is unauthenticated and remotely accessible, (3) email workflow integrity is critical to business operations, (4) the vendor has not yet released a patch, and (5) compensating controls are complex to deploy. Organizations should treat this as a high-priority tactical fix while awaiting a vendor patch.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-based attack with low complexity and no privilege requirement, but limited to integrity and availability impact (no confidentiality loss). The score does not account for the public availability of exploit code or the lack of vendor patch availability. For risk prioritization, organizations should elevate this above the base score due to exploitability and business criticality of email delivery.

Frequently asked questions