CVE-2026-111358: sendportal-core 0 through 4.0.1

Affected technology

sendportal-core · 0 through 4.0.1
mettle

Description’s affected range: through 4.0.1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality and integrity impact as low; availability impact as none.