Is CVE-2026-15191 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15191 being exploited in the wild.

How severe is CVE-2026-15191?

Medium severity, with a CVSS score of 6.3, published 9 July 2026.

Is there a fix for CVE-2026-15191?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15191 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-15191?

Check whether you run Mettle Sendportal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15191: Mettle SendPortal authorization bypass in Campaign Creation Endpoint

CVE-2026-15191 · Severity: medium · CVSS 6.3 · Published 2026-07-09

Mettle SendPortal is an open-source email marketing platform. A security flaw in the campaign creation process allows a user in one workspace to use email delivery services belonging to a different workspace. This could lead to unauthorized use of resources, potential data exposure, and the ability for one customer to send emails using another customer's configured credentials and reputation.

Technologies: Mettle Sendportal. Vendors: Mettle.

Quick answers

Is CVE-2026-15191 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15191 being exploited in the wild.
How severe is CVE-2026-15191?: Medium severity, with a CVSS score of 6.3, published 9 July 2026.
Which products and versions are affected?: Mettle Sendportal up to 3.0.1.
Is there a fix for CVE-2026-15191?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15191 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-15191?: Check whether you run Mettle Sendportal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass (IDOR) exists in the Campaign Creation Endpoint due to improper validation of the 'email_service_id' parameter. The 'CampaignStoreRequest.php' component validates that the provided ID exists in the database but fails to verify that the ID belongs to the authenticated user's workspace. Consequently, an attacker can provide an ID belonging to a different tenant, and the dispatch layer ('ResolveEmailService.php') will proceed to use that foreign resource without further ownership checks. This allows for cross-tenant resource usage and breaks tenant isolation. As of the advisory date, the project has been informed but a formal patch has not been confirmed.

Affected products

Mettle SendPortal up to 3.0.1

Timeline

2026-06-07: disclosed: Issue reported to the project via GitHub issue #339
2026-07-09: advisory: CVE published and NVD entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.