CVE-2026-111358 SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form
Authenticated users can attach subscribers to other workspaces' tags via unvalidated IDs, allowing access to victim campaign content and report manipulation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111358?
CVE-2026-111358 is a medium-severity missing authorization vulnerability in mettle sendportal-core, published on 15 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.
Weakness: CWE-639
Which versions are affected by CVE-2026-111358?
How do I fix CVE-2026-111358?
No fix has been published for CVE-2026-111358 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111358 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111358 exists.
Sources
Also known as GHSA-9w73-g77r-h565.