sendportal-core vulnerabilities

CVEs whose affected-version data names the sendportal-core package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111358Medium· 5.4

yesterday

SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit se…

▾ Sunlitmettle · sendportal-corevia CVEORG