sendportal CVE-2026-15192

Q: What is the CVSS score of CVE-2026-15192?

CVE-2026-15192 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-42624 MEDIUM

Improper Authentication (CWE-287)

2026-07-09 cna@vuldb.com

GHSA-qcqf-phv4-c959

Authentication Bypass

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint with no credentials required; impact limited to integrity and availability of email records, no confidentiality loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 17:37 vuln.today

DescriptionCVE.org

A vulnerability has been found in mettle sendportal up to 3.0.1. This issue affects the function sendgrid/postmark/postal/mailjet of the component APIv1 Webhooks. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Missing authentication on APIv1 webhook endpoints in sendportal up to 3.0.1 permits remote unauthenticated actors to invoke webhook handlers for SendGrid, Postmark, Postal, and Mailjet without any credential verification. The flaw enables integrity and availability manipulation of email processing pipelines from any network location. A publicly disclosed exploit exists per VulDB submission 851624; no vendor patch has been released and the maintainer has not responded to the responsible disclosure report.

Technical ContextAI

sendportal is a self-hosted, open-source email marketing platform built by mettle. Its APIv1 layer exposes webhook receiver endpoints for four transactional/marketing email service providers - SendGrid, Postmark, Postal, and Mailjet - which are designed to accept inbound event notifications (bounces, deliveries, unsubscribes, spam reports) from those providers. CWE-287 (Improper Authentication) indicates these endpoints process incoming POST requests without validating an authenticating secret, HMAC signature, or bearer token that would confirm the request originated from the legitimate upstream ESP. Without this check, any remote party can forge webhook events, potentially injecting false delivery statuses, suppression list entries, or triggering unsubscribe actions against arbitrary contacts.

RemediationAI

No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the disclosure per issue #340 at https://github.com/mettle/sendportal/issues/340. As a compensating control, restrict network access to the APIv1 webhook endpoints at the reverse-proxy or firewall layer, allowing inbound POST requests only from the published IP ranges of the configured ESP (SendGrid, Postmark, Postal, or Mailjet publish their webhook source IPs). This reduces exposure without disabling functionality, but requires ongoing maintenance as ESP IP ranges change. Alternatively, disable unused webhook integrations in the sendportal configuration to reduce attack surface. Organizations should monitor the upstream repository for a patch release and apply it immediately when available. The VulDB CTI entry https://vuldb.com/vuln/377118/cti may be monitored for updated patch status.