CVE-2026-7145

MEDIUM

mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization

Title source: cna
STIX 2.1

Description

A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php of the component Invitation Handler. This manipulation of the argument invitation causes authorization bypass. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-359744 | mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization
https://vuldb.com/vuln/359744
Signature, Permissions Required signature permissions-required
VDB-359744 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/359744/cti
Third Party Advisory third-party-advisory
Submit #801781 | mettle sendportal v3.0.1 Insecure direct object reference
https://vuldb.com/submit/801781
Issue Tracking issue-tracking
https://github.com/mettle/sendportal/issues/337

Scores

CVSS v3 5.4
EPSS 0.0024
EPSS Percentile 14.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-285 CWE-639
Status published
Products (2)
mettle/sendportal 3.0.0
mettle/sendportal 3.0.1
Published Apr 27, 2026
Tracked Since Apr 27, 2026