Executive brief
Mettle SendPortal is an open-source email marketing platform. A security flaw in the campaign creation process allows a user in one workspace to use email delivery services belonging to a different workspace. This could lead to unauthorized use of resources, potential data exposure, and the ability for one customer to send emails using another customer's configured credentials and reputation.
Technical details
An authorization bypass (IDOR) exists in the Campaign Creation Endpoint due to improper validation of the 'email_service_id' parameter. The 'CampaignStoreRequest.php' component validates that the provided ID exists in the database but fails to verify that the ID belongs to the authenticated user's workspace. Consequently, an attacker can provide an ID belonging to a different tenant, and the dispatch layer ('ResolveEmailService.php') will proceed to use that foreign resource without further ownership checks. This allows for cross-tenant resource usage and breaks tenant isolation. As of the advisory date, the project has been informed but a formal patch has not been confirmed.
Affected products
- Mettle SendPortal up to 3.0.1
Timeline
- 2026-06-07: disclosed: Issue reported to the project via GitHub issue #339
- 2026-07-09: advisory: CVE published and NVD entry created