Is CVE-2026-15192 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15192 being exploited in the wild.

How severe is CVE-2026-15192?

Medium severity, with a CVSS score of 6.5, published 9 July 2026.

Is there a fix for CVE-2026-15192?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15192 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-15192?

Check whether you run Mettle Sendportal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15192: Mettle SendPortal missing authentication in APIv1 Webhooks

CVE-2026-15192 · Severity: medium · CVSS 6.5 · Published 2026-07-09

Mettle SendPortal, an open-source email marketing platform, contains a security flaw in how it handles notifications from email service providers like SendGrid and Mailjet. An attacker can send fake notifications to the system to trick it into marking legitimate subscribers as 'unsubscribed' or 'bounced.' This can disrupt marketing operations by silently excluding customers from future email campaigns and damaging the sender's reputation.

Technologies: Mettle Sendportal. Vendors: Mettle.

Quick answers

Is CVE-2026-15192 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15192 being exploited in the wild.
How severe is CVE-2026-15192?: Medium severity, with a CVSS score of 6.5, published 9 July 2026.
Which products and versions are affected?: Mettle Sendportal up to 3.0.1.
Is there a fix for CVE-2026-15192?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15192 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-15192?: Check whether you run Mettle Sendportal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability exists in the APIv1 Webhook handlers for SendGrid, Postmark, Postal, and Mailjet in Mettle SendPortal up to 3.0.1. The application fails to verify the cryptographic signatures (such as the X-Twilio-Email-Event-Webhook-Signature header) provided by email service providers to ensure the authenticity of incoming webhooks. A remote, unauthenticated attacker with knowledge of a valid message identifier can submit forged JSON payloads to these endpoints. This allows the attacker to trigger 'bounce' or 'unsubscribe' events, leading to unauthorized modification of subscriber states and their exclusion from future email campaigns. As of the advisory date, no official patch has been released.

Affected products

Mettle SendPortal up to 3.0.1

Timeline

2026-06-07: disclosed: Issue reported to the project maintainers via GitHub
2026-07-09: advisory: CVE published by VulDB/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.