CVE-2026-15191

MEDIUM 6.3

mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization

CVSS Score

6.3

EPSS Score

0.2%

EPSS Percentile

12th

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php of the component Campaign Creation Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-639 CWE-285
Vendor	mettle
Product	sendportal
Published	Jul 9, 2026
Last Updated	Jul 14, 2026

Stay Ahead of the Next One

Get instant alerts for mettle sendportal

Be the first to know when new medium vulnerabilities affecting mettle sendportal are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

mettle / sendportal

3.0.0 3.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/377117 vuldb.com: https://vuldb.com/vuln/377117/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15191 vuldb.com: https://vuldb.com/submit/851622 github.com: https://github.com/mettle/sendportal/issues/339 github.com: https://github.com/mettle/sendportal/

Credits

🔍 Superman_04 (VulDB User) VulDB CNA Team