Is there a public PoC exploit available for EUVD-2026-42619?

Yes, a public proof-of-concept exploit is available for EUVD-2026-42619. Prioritise patching immediately. EPSS: 0.2%.

mettle Sendportal EUVD-2026-42619

Q: What is the CVSS score of EUVD-2026-42619?

EUVD-2026-42619 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-15191 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-09 VulDB

GHSA-274r-rpm4-6m3r

PHP Authentication Bypass Sendportal Mettle

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable endpoint requires authenticated user (PR:L); IDOR yields low confidentiality and integrity impact on campaign data with no availability impact evident.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 17:24 vuln.today

Severity Changed

Jul 09, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

Jul 09, 2026 - 17:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php of the component Campaign Creation Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Authorization bypass in mettle Sendportal up to version 3.0.1 permits authenticated remote users to circumvent object-level access controls at the Campaign Creation Endpoint, potentially allowing cross-tenant campaign manipulation. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a class of IDOR flaw where the server trusts a user-supplied identifier to gate resource access without re-verifying ownership. A publicly available exploit exists via GitHub issue #339, and the vendor has not responded to responsible disclosure; no patch is available at time of analysis.

Technical ContextAI

Sendportal is an open-source, PHP/Laravel-based self-hosted email marketing platform developed by mettle. The affected code path is vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php, the Laravel Form Request class responsible for authorizing and validating inbound campaign creation requests. CWE-639 (Authorization Bypass Through User-Controlled Key) identifies the root cause: the authorization logic relies on a user-controllable key - such as a workspace or team identifier embedded in the request payload or route parameter - without server-side re-verification that the authenticated user actually owns or is permitted to act on the referenced resource. The CPE cpe:2.3:a:mettle:sendportal:*:*:*:*:*:*:*:* covers all tracked versions through 3.0.1, with no upper-bound exclusion, indicating no patched release has been identified.

RemediationAI

No vendor-released patch identified at time of analysis. The responsible disclosure was submitted via GitHub issue https://github.com/mettle/sendportal/issues/339, but the vendor has not responded. As an immediate compensating control, restrict campaign creation permissions to the minimum necessary set of trusted users, reducing the population of accounts that could exploit the IDOR flaw. Administrators should add custom server-side ownership validation in CampaignStoreRequest.php to re-verify that the authenticated user's workspace ID matches the resource identifier supplied in the request - this trade-off requires code modification but closes the authorization gap without disabling campaign functionality. If multi-tenant isolation is critical, consider temporarily disabling campaign creation for non-admin roles until a patch is released, accepting the operational impact of restricted campaign management. Monitor https://github.com/mettle/sendportal/ and https://vuldb.com/cve/CVE-2026-15191 for patch releases.