CVE-2026-15191 in sendportal
Summary
by MITRE • 07/09/2026
A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php of the component Campaign Creation Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/14/2026
This vulnerability resides within the sendportal platform version 3.0.1 and earlier, specifically targeting the Campaign Creation Endpoint functionality. The flaw exists in the CampaignStoreRequest.php file located within the vendor/mettle/sendportal-core/src/Http/Requests/ directory, making it a critical component of the application's request handling mechanism. The vulnerability manifests as an authorization bypass issue that allows attackers to manipulate the campaign creation process without proper authentication or authorization.
The technical nature of this flaw indicates a weakness in the input validation and access control mechanisms implemented within the campaign creation endpoint. When users attempt to create campaigns through the API or web interface, the system fails to properly validate user permissions or authenticate requests before processing the campaign data. This authorization bypass vulnerability stems from insufficient security controls that should normally verify whether an authenticated user possesses the necessary privileges to create new campaigns within the sendportal system.
The operational impact of this vulnerability is significant as it allows remote exploitation without requiring any prior authentication credentials. Attackers can leverage this flaw to submit malicious campaign requests that bypass normal access controls, potentially enabling them to create unauthorized campaigns or manipulate existing ones. The fact that the exploit has been published and may be actively used indicates that threat actors have already identified and weaponized this vulnerability. This remote attack vector means that any user with access to the sendportal application's network can potentially exploit this weakness without needing physical access to the system.
The security implications extend beyond simple unauthorized campaign creation, as this authorization bypass could enable attackers to potentially escalate their privileges within the system or gain access to sensitive campaign data and associated user information. The vulnerability affects the core functionality of the platform's campaign management system, which is likely used for email marketing and communication automation processes that may contain sensitive business or customer data.
Organizations using sendportal versions up to 3.0.1 should immediately implement mitigations including updating to the latest stable version where the vulnerability has been patched, implementing additional access controls at the network level, and monitoring for unauthorized campaign creation activities. The lack of response from the project maintainers despite early notification through issue reports suggests potential delays in patch development or deployment that organizations must account for in their risk management strategies.
This vulnerability aligns with common security weaknesses documented in CWE categories related to improper authorization and input validation failures, representing a critical gap in the application's security architecture. The attack pattern follows typical remote exploitation techniques described in MITRE ATT&CK framework under privilege escalation and command and control categories, where attackers leverage application-level vulnerabilities to gain unauthorized access to system resources.
Security professionals should conduct immediate assessments of their sendportal installations to determine if any systems are vulnerable to this authorization bypass issue. The remediation process should include not only applying the official patch but also implementing comprehensive monitoring solutions to detect potential exploitation attempts and establishing incident response procedures for handling such security events. Organizations should also review their overall security posture and implement additional layers of protection around critical application endpoints to prevent similar vulnerabilities from being exploited in other system components.
The publication of this exploit demonstrates the ongoing challenge organizations face with maintaining secure software environments, particularly when dealing with open source projects that may not receive timely security updates or patches. The vulnerability highlights the importance of proactive security measures including regular security assessments, vulnerability scanning, and maintaining updated security monitoring tools to detect and respond to threats before they can be fully exploited in production environments.