The vulnerability CVE-2026-15192 in mettle sendportal up to version 3.0.1 involves missing authentication in the APIv1 Webhooks component's sendgrid, postmark, postal, and mailjet functions. This flaw permits remote attackers to interact with these webhook endpoints without authentication, potentially allowing unauthorized actions. The issue was reported early to the project, but no response or remediation has been issued. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

The missing authentication in critical webhook functions can allow remote attackers to invoke these endpoints without authorization. This may lead to unauthorized access or manipulation of webhook-related operations within the sendportal application. The exact impact depends on the webhook functionality but generally represents a significant security risk due to lack of authentication controls.

No official fix or patch is currently available for this vulnerability. Since the vendor has not responded or provided remediation guidance, users should consider implementing compensating controls such as restricting network access to the affected webhook endpoints, using firewall rules or API gateways to enforce authentication, or disabling the vulnerable webhook integrations if feasible. Monitor vendor channels for any future updates or patches.