SendPortal sendportal-core through 4.0.1 contains an authorization bypass that lets any authenticated workspace member attach subscribers to tag lists in other workspaces by supplying unvalidated tag IDs. The flaw allows an attacker to submit sequential tag IDs through the web subscriber form or a CSV import, thereby granting the attacker access to campaign content that belongs to victim workspaces and distorting victim reports. The weakness is a classic authorization bypass through user‑controlled keys and results in unauthorized data exposure and integrity tampering.

Vendor mettle releases the sendportal-core package. The affected version is 4.0.1. No other versions are listed as impacted.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is 0.26%. The necessary conditions for exploitation are modest: the attacker must be an authenticated workspace member and must supply tag identifiers that belong to another workspace. Because the attack vector is confined to legitimate workspace credentials, the exploitation requires no public information or elevated privileges, making it feasible for insider threats or compromised accounts. The vulnerability is not listed in the CISA KEV catalog, but it still offers a pathway to unauthorized data access and report manipulation.