# CVE-2026-111358: SendPortal sendportal-core authorization bypass in subscriber tagging

Source: https://junglewise.ai/threats/cve-2026-111358-sendportal-sendportal-core-through-4-0-1-contains-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111358 · Severity: medium · CVSS 5.4 · Published 2026-10-15

SendPortal is an open-source email marketing platform used to manage subscriber lists and send campaigns. An authenticated workspace member can exploit an authorization flaw to attach subscribers to tags belonging to other workspaces, allowing them to intercept victim campaign content and manipulate campaign analytics. This attack requires only valid workspace credentials but does not expose account passwords or system control.

Vendors: [Mettle](https://junglewise.ai/threats/vendors/mettle).

## Quick answers

**Is CVE-2026-111358 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111358 being exploited in the wild.

**How severe is CVE-2026-111358?** Medium severity, with a CVSS score of 5.4, published 15 October 2026.

**Which products and versions are affected?** Mettle Sendportal-Core through 4.0.1.

**Is there a fix for CVE-2026-111358?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111358 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111358?** Check whether you run Mettle Sendportal-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in subscriber tag assignment where tag IDs are not validated to belong to the requesting user's workspace. Authenticated attackers can submit arbitrary tag IDs via the web subscriber form or CSV import endpoint, bypassing workspace isolation. The attack is network-accessible to any authenticated workspace member and requires no elevated privileges or user interaction beyond API calls.

## Affected products

- Mettle sendportal-core through 4.0.1

## Timeline

- 2026-10-15: disclosed

## References

- [https://github.com/mettle/sendportal-core](https://github.com/mettle/sendportal-core)
- [https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Http/Requests/SubscriberRequest.php](https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Http/Requests/SubscriberRequest.php)