PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111358 mettle CVE debrief

CVE-2026-111358 SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form. This vulnerability allows authenticated workspace members to attach subscribers to other workspaces' tags, potentially leading to unauthorized access to sensitive campaign content and data integrity issues. Defenders should assess exposure and prioritize remediation, especially in environments using SendPortal sendportal-core versions up to 4.0.1. The vulnerability is a medium-severity authorization bypass issue that can be exploited via the web subscriber form or CSV import.

Vendor
mettle
Product
sendportal-core
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-15
Original CVE updated
2026-10-16
Advisory published
2026-10-15
Advisory updated
2026-10-16

Who should care

Defenders responsible for SendPortal sendportal-core installations, especially those using versions up to 4.0.1, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and remediate this vulnerability in their environments.

Why it matters

CVE-2026-111358 is a medium-severity vulnerability in SendPortal sendportal-core that allows authenticated workspace members to attach subscribers to other workspaces' tags, potentially leading to unauthorized access to sensitive campaign content and data integrity issues.

  • Potential unauthorized access to sensitive campaign content
  • Possible data integrity issues due to unauthorized tag attachments
  • Required verification of SendPortal sendportal-core version and exposure
  • Potential impact on reporting and analytics due to unauthorized subscriber attachments

Technical summary

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. This can be exploited via the web subscriber form or CSV import, potentially leading to unauthorized access to sensitive campaign content and data integrity issues. The vulnerability is a medium-severity issue that requires verification and remediation, especially in environments using SendPortal sendportal-core versions up to 4.0.1.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their environments, especially those using SendPortal sendportal-core versions up to 4.0.1.

Recommended defensive actions

  • Verify SendPortal sendportal-core version and check for exposure
  • Restrict access to subscriber form and CSV import
  • Monitor for suspicious tag attachment activity
  • Apply vendor-provided patches or updates
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the authorization bypass vulnerability in SendPortal sendportal-core through 4.0.1, allowing authenticated workspace members to attach subscribers to other workspaces' tags.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111358 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111358

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111358 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111358

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111358.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Repositories/Subscribers/BaseSubscriberTenantRepository.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Http/Requests/SubscriberRequest.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/mettle/sendportal-core

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/sendportal-sendportal-core-through-4.0.1-cross-workspace-tag-attachment-via-subscriber-form

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.