Mettle
Monthly
Authorization bypass in mettle Sendportal up to version 3.0.1 permits authenticated remote users to circumvent object-level access controls at the Campaign Creation Endpoint, potentially allowing cross-tenant campaign manipulation. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a class of IDOR flaw where the server trusts a user-supplied identifier to gate resource access without re-verifying ownership. A publicly available exploit exists via GitHub issue #339, and the vendor has not responded to responsible disclosure; no patch is available at time of analysis.
Stored or reflected cross-site scripting in sendportal's Campaign Handler allows an authenticated low-privilege remote attacker to inject malicious script via the 'content' argument at the /webview/ endpoint, affecting all versions up to and including 3.0.1. A victim user must interact with the crafted content for the payload to execute, resulting in low-integrity impact with no confidentiality or availability consequences. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists (E:P in CVSS temporal), and the vendor has not responded to the coordinated disclosure, leaving no patch available.
Authorization bypass in SendPortal's workspace invitation handler allows authenticated low-privilege users to delete workspace invitations they do not own by manipulating the invitation identifier in the destroy endpoint. Versions 3.0.0 and 3.0.1 are confirmed affected per EUVD-2026-25896. The vendor has not responded to responsible disclosure; no patch is available, no public exploit code exists, and no active exploitation has been confirmed (not in CISA KEV), making this a low-urgency finding with limited blast radius.
Authorization bypass in mettle Sendportal up to version 3.0.1 permits authenticated remote users to circumvent object-level access controls at the Campaign Creation Endpoint, potentially allowing cross-tenant campaign manipulation. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a class of IDOR flaw where the server trusts a user-supplied identifier to gate resource access without re-verifying ownership. A publicly available exploit exists via GitHub issue #339, and the vendor has not responded to responsible disclosure; no patch is available at time of analysis.
Stored or reflected cross-site scripting in sendportal's Campaign Handler allows an authenticated low-privilege remote attacker to inject malicious script via the 'content' argument at the /webview/ endpoint, affecting all versions up to and including 3.0.1. A victim user must interact with the crafted content for the payload to execute, resulting in low-integrity impact with no confidentiality or availability consequences. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists (E:P in CVSS temporal), and the vendor has not responded to the coordinated disclosure, leaving no patch available.
Authorization bypass in SendPortal's workspace invitation handler allows authenticated low-privilege users to delete workspace invitations they do not own by manipulating the invitation identifier in the destroy endpoint. Versions 3.0.0 and 3.0.1 are confirmed affected per EUVD-2026-25896. The vendor has not responded to responsible disclosure; no patch is available, no public exploit code exists, and no active exploitation has been confirmed (not in CISA KEV), making this a low-urgency finding with limited blast radius.