Executive brief
Mettle SendPortal, an open-source email marketing platform, contains a security flaw in how it handles notifications from email service providers like SendGrid and Mailjet. An attacker can send fake notifications to the system to trick it into marking legitimate subscribers as 'unsubscribed' or 'bounced.' This can disrupt marketing operations by silently excluding customers from future email campaigns and damaging the sender's reputation.
Technical details
A missing authentication vulnerability exists in the APIv1 Webhook handlers for SendGrid, Postmark, Postal, and Mailjet in Mettle SendPortal up to 3.0.1. The application fails to verify the cryptographic signatures (such as the X-Twilio-Email-Event-Webhook-Signature header) provided by email service providers to ensure the authenticity of incoming webhooks. A remote, unauthenticated attacker with knowledge of a valid message identifier can submit forged JSON payloads to these endpoints. This allows the attacker to trigger 'bounce' or 'unsubscribe' events, leading to unauthorized modification of subscriber states and their exclusion from future email campaigns. As of the advisory date, no official patch has been released.
Affected products
- Mettle SendPortal up to 3.0.1
Timeline
- 2026-06-07: disclosed: Issue reported to the project maintainers via GitHub
- 2026-07-09: advisory: CVE published by VulDB/NVD