CVE-2026-111358: SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form
SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated member of any SendPortal workspace can exploit it. The attacker needs access to the web subscriber form or CSV import functionality and can supply tag IDs belonging to another workspace.
Are default deployments affected?
The provided information does not identify any configuration prerequisite or optional feature that must be enabled. The affected paths are the web subscriber form and CSV import, so deployments exposing either workflow to authenticated workspace members may be affected.
What is the impact of successful exploitation?
An attacker can attach subscribers to tags in another workspace. This can cause those subscribers to receive campaign content intended for the victim workspace and can distort the victim's reporting data.
How can I look for evidence of exploitation?
Review subscriber form submissions and CSV imports for tag IDs that do not belong to the submitting member's workspace. Investigate cross-workspace subscriber-to-tag associations, particularly tags with sequential IDs that may have been enumerated.
What can be done while patching is unavailable?
Restrict access to subscriber creation and CSV import functions to trusted workspace members, and monitor or review submitted tag IDs for workspace ownership. Remove any identified cross-workspace subscriber-tag associations and assess resulting campaign deliveries and reporting changes.