Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111358— SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form

Quick assessment

Affected
mettle sendportal-core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SendPortal sendportal-core 4.0.1 及更早版本存在一个授权绕过漏洞，该漏洞允许已认证的工作区成员通过提供未经验证的标签 ID，将订阅者附加到其他工作区的标签上。攻击者可以通过网页订阅者表单或 CSV 导入提交连续的标签 ID，从而获取受害者的活动内容，并扭曲受害者的报告数据。

CVSS 5.4 · Medium EPSS 0.26% · P17

Affected Version Matrix 1

VendorProduct Version RangeStatus
mettle sendportal-core ≤ 4.0.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111358

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form
Source: CVE Program / CVE List V5
Vulnerability Description
SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
mettle sendportal-core 0 ~ 4.0.1 -

II. Public POCs for CVE-2026-111358

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111358

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-111358 (1)

Proof of Concept for CVE-2026-111358 (1)

Security Blog Posts for CVE-2026-111358 (1)

Vendor Pages for CVE-2026-111358 (1)

IV. Related Vulnerabilities

Same vendor: mettle
Same weakness: CWE-639

V. Comments for CVE-2026-111358

No comments yet

Leave a comment