CVE-2026-111358 in sendportal-core
Summary
by MITRE • 10/16/2026
SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
SendPortal versions through 4.0.1 are affected by a critical authorization bypass vulnerability within its core functionality, specifically impacting how workspace members interact with tags associated with subscribers. This flaw stems from an insufficient validation of input parameters during the process of attaching or associating subscribers to specific tags. In a properly secured multi-tenant application like SendPortal, which is designed for managing email marketing campaigns across distinct organizational units known as workspaces, strict isolation between these entities is paramount. The vulnerability arises because the backend logic fails to verify that the tag ID provided by an authenticated user actually belongs to the same workspace as the subscriber being modified or the requesting user's own permissions context. This lack of server-side authorization checks allows any authenticated member within a workspace to manipulate data belonging to other workspaces, effectively breaking the logical isolation boundaries intended to protect sensitive marketing data and campaign structures.
The technical mechanism of this exploitation involves an attacker submitting unvalidated tag IDs through standard application interfaces, such as the web-based subscriber form or via bulk CSV imports. By supplying sequential or guessed tag identifiers that correspond to tags in different workspaces, the malicious actor can force subscribers from their own workspace to be associated with targets outside their authorized scope. This action does not require elevated privileges beyond basic authentication; it relies entirely on the application's failure to cross-reference the provided resource ID against the user's assigned workspace permissions or the tag's actual ownership metadata. Consequently, an attacker can systematically iterate through potential tag IDs to discover and interact with resources in other workspaces, demonstrating a classic Broken Access Control flaw where the system trusts client-supplied identifiers without verifying their legitimacy within the current security context.
The operational impact of this vulnerability is significant for organizations relying on SendPortal for customer relationship management and email marketing integrity. By attaching subscribers to tags belonging to other workspaces, attackers can gain unauthorized access to campaign content that was intended for different audiences or internal teams. This exposure compromises the confidentiality of proprietary marketing strategies, audience segmentation data, and potentially sensitive subscriber information if such details are exposed through tag-based filtering mechanisms. Furthermore, this manipulation skews analytical reports generated by the platform. Since reporting metrics often rely on accurate associations between subscribers and tags to calculate open rates, click-throughs, or campaign performance per segment, injecting foreign subscriptions into unrelated tags distorts these statistics. This can lead to erroneous business decisions based on corrupted data and may also trigger unintended automated email sequences if those tags are linked to specific workflow automations, resulting in spamming of external contacts and potential damage to the organization's sender reputation.
To mitigate this vulnerability, immediate action is required for all administrators running SendPortal versions up to 4.0.1. The primary remediation step is to upgrade the application to version 4.0.2 or later, where the developers have implemented proper authorization checks to ensure that tag IDs are validated against workspace boundaries before any subscriber associations are processed. Until an update can be applied, administrators should consider restricting access to CSV import features and web forms if possible, although this is a less effective workaround given the nature of the flaw being in the API logic itself rather than just the interface. Additionally, implementing strict input validation on the server side for all resource identifiers related to tags and subscribers is essential. Security teams should also monitor logs for unusual patterns of tag ID requests or rapid sequential access attempts that may indicate exploitation activity. This incident highlights the importance of enforcing principle of least privilege and ensuring robust object-level authorization checks in multi-tenant SaaS applications, aligning with industry standards such as CWE-639 (Authorization Bypass Through User-Controlled Key) and MITRE ATT&CK technique T1078 (Valid Accounts), which describes how attackers use legitimate credentials to access resources they are not authorized for.