An authorization bypass vulnerability has been identified in mettle sendportal versions 3.0.0 and 3.0.1. The issue resides in the Campaign Creation Endpoint component, within the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php. Remote attackers can exploit this flaw to bypass authorization mechanisms, potentially allowing unauthorized actions related to campaign creation. The vulnerability was responsibly disclosed to the project, but no response or fix has been issued. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. Exploit code has been published, but no known active exploitation in the wild is reported.

Successful exploitation of this vulnerability could allow remote attackers to bypass authorization controls on the campaign creation endpoint, potentially enabling unauthorized creation or manipulation of campaigns. The impact is rated medium due to limited impact on confidentiality, integrity, and availability as per the CVSS vector. There is no indication of privilege escalation or complete system compromise from the provided data.

No official patch or remediation is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the affected endpoint and monitor for suspicious activity related to campaign creation. Avoid exposing the vulnerable versions (3.0.0 and 3.0.1) to untrusted networks where possible.