# CVE-2026-15191: Mettle SendPortal authorization bypass in Campaign Creation Endpoint

Source: https://junglewise.ai/threats/cve-2026-15191-mettle-sendportal-authorization-bypass-in-campaign-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-15191 · Severity: medium · CVSS 6.3 · Published 2026-07-09

Mettle SendPortal is an open-source email marketing platform. A security flaw in the campaign creation process allows a user in one workspace to use email delivery services belonging to a different workspace. This could lead to unauthorized use of resources, potential data exposure, and the ability for one customer to send emails using another customer's configured credentials and reputation.

Technologies: [Mettle Sendportal](https://junglewise.ai/threats/technologies/sendportal). Vendors: [Mettle](https://junglewise.ai/threats/vendors/mettle).

## Quick answers

**Is CVE-2026-15191 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15191 being exploited in the wild.

**How severe is CVE-2026-15191?** Medium severity, with a CVSS score of 6.3, published 9 July 2026.

**Which products and versions are affected?** Mettle Sendportal up to 3.0.1.

**Is there a fix for CVE-2026-15191?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15191 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-15191?** Check whether you run Mettle Sendportal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass (IDOR) exists in the Campaign Creation Endpoint due to improper validation of the 'email_service_id' parameter. The 'CampaignStoreRequest.php' component validates that the provided ID exists in the database but fails to verify that the ID belongs to the authenticated user's workspace. Consequently, an attacker can provide an ID belonging to a different tenant, and the dispatch layer ('ResolveEmailService.php') will proceed to use that foreign resource without further ownership checks. This allows for cross-tenant resource usage and breaks tenant isolation. As of the advisory date, the project has been informed but a formal patch has not been confirmed.

## Affected products

- Mettle SendPortal up to 3.0.1

## Timeline

- 2026-06-07: disclosed: Issue reported to the project via GitHub issue #339
- 2026-07-09: advisory: CVE published and NVD entry created

## References

- [https://github.com/mettle/sendportal/](https://github.com/mettle/sendportal/)
- [https://github.com/mettle/sendportal/issues/339](https://github.com/mettle/sendportal/issues/339)
- [https://vuldb.com/cve/CVE-2026-15191](https://vuldb.com/cve/CVE-2026-15191)
- [https://vuldb.com/submit/851622](https://vuldb.com/submit/851622)
- [https://vuldb.com/vuln/377117](https://vuldb.com/vuln/377117)
- [https://vuldb.com/vuln/377117/cti](https://vuldb.com/vuln/377117/cti)

## Related threats

- [Mettle SendPortal stored XSS in template management](https://junglewise.ai/threats/cve-2026-26483-mettle-sendportal-stored-xss-in-template-management)
- [Mettle SendPortal missing authentication in APIv1 Webhooks](https://junglewise.ai/threats/cve-2026-15192-mettle-sendportal-missing-authentication-in-apiv1-webhooks)
- [Mettle Sendportal stored XSS in Campaign webview](https://junglewise.ai/threats/cve-2026-10234-mettle-sendportal-stored-xss-in-campaign-webview)