CVE-2026-15191 | A flaw has been found in mettle sendportal up to 3.0.1. This… | CVSS 6.3 MEDIUM

Description

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php of the component Campaign Creation Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metadata

CVE ID: CVE-2026-15191
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-09 05:33 UTC
Published: 2026-07-09 16:00 UTC
Last updated: 2026-07-09 16:00 UTC
Primary CWE: CWE-639
Authorization Bypass
Vendor / Product: mettle / sendportal
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
mettle	sendportal	—	3.0.0, 3.0.1

Weakness (CWE)

CWE	Source	Description
CWE-285	cna	Improper Authorization
CWE-639	cna	Authorization Bypass

CVSS scores (4)

Score	Severity	Version	Source	Vector
6.5	N/D	2.0	cna	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
6.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.3	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (6)

VDB-377117 | mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization https://vuldb.com/vuln/377117
VDB-377117 | CTI Indicators (IOB, IOC, IOA) https://vuldb.com/vuln/377117/cti
CVE-2026-15191 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-15191
Submit #851622 | Mettle SendPortal Latest Authorization Bypass https://vuldb.com/submit/851622
https://github.com/mettle/sendportal/issues/339
https://github.com/mettle/sendportal/