SendPortal Core CVE-2026-111358

Requires a valid authenticated account in at least one SendPortal workspace (PR:L); the multi-tenant/workspace deployment mode must be in use, and a victim workspace must exist alongside the attacker's. Exploitation is performed specifically via the subscriber creation path - the web subscriber form or the CSV import feature - where the tag ID field accepts attacker-supplied values that are not validated against the caller's own workspace (per BaseSubscriberTenantRepository and SubscriberRequest). Limiting factors: no anonymous access (authentication needed), impact is confined to cross-workspace tag attachment (campaign content exposure and report skew) rather than full data compromise, and single-tenant or single-workspace installations have no victim to target.

This is a medium-severity authorization (not authentication) flaw: CVSS 4.0 5.3 with AV:N/AC:L/PR:L/UI:N and only Low confidentiality and integrity impact (VC:L/VI:L), no availability impact. The PR:L metric confirms an attacker must already be an authenticated member of some workspace - this is an insider/cross-tenant abuse case, not an anonymous internet attack. CWE-639 (Authorization Bypass Through User-Controlled Key) matches the described insecure direct object reference on tag IDs. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public exploit flag was provided; the referenced HackMD write-up and VulnCheck advisory describe the technique but are not confirmed weaponized exploit code. Net: a real but bounded multi-tenancy integrity/confidentiality issue most relevant to shared SendPortal deployments, not a mass-exploitation priority. No conflicting signals in the raw data, though the input Tag 'Authentication Bypass' conflicts with the CWE-639/description, which is clearly an authorization bypass.

An authenticated member of one SendPortal workspace creates or imports a subscriber and manually supplies a sequential tag ID belonging to a victim workspace through the web subscriber form or CSV import. Because the tag ID is not validated against the attacker's own workspace, the subscriber is attached to the victim's tag, causing them to receive the victim's campaign emails and polluting the victim's engagement reports. No public exploit code was identified at time of analysis, but the technique is documented in the referenced HackMD and VulnCheck advisories.