An authorization bypass vulnerability exists in mettle sendportal versions 3.0.0 and 3.0.1 within the Campaign Creation Endpoint (vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php). This flaw allows remote attackers to manipulate requests to bypass authorization checks. Although the vulnerability was responsibly disclosed early, the vendor has not yet issued a fix or official response. Exploit code is publicly available, increasing the risk of exploitation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to unauthorized access to campaign creation functionality in mettle sendportal, potentially allowing attackers to perform actions without proper authorization. The impact is rated medium due to limited confidentiality, integrity, and availability impact, but the ability to bypass authorization remotely increases risk.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a patch is released, consider restricting access to the affected endpoint through network controls or additional authentication layers to mitigate unauthorized use. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.