A flaw in the APIv1 Webhooks component of Mettle Sendportal allows remote actors to send crafted requests that bypass authentication checks for the sendgrid, postmark, postal, and mailjet webhook endpoints. The weakness lies in improper authentication handling (CWE‑287) and missing authentication validations (CWE‑306). An attacker can trigger the webhook handlers without providing valid credentials, which can lead to unintended service actions, exposure of data to unauthorized parties, or denial of functionality for legitimate users.

The vulnerability affects all installations of Mettle Sendportal version 3.0.1 and earlier. Any deployment that exposes the APIv1 Webhooks endpoints—sendgrid, postmark, postal, or mailjet—demands careful review, as all are susceptible regardless of host configuration.

The CVSS score of 6.9 indicates moderate severity. The exploit is publicly disclosed and can be executed remotely by sending crafted HTTP requests to the vulnerable endpoints. The EPSS score of <1% suggests a very low likelihood of current exploitation, and the flaw is not listed in CISA’s KEV catalog, implying no confirmed wild exploits yet.