CVE-2026-7145

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7145", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-26T19:53:34.428Z", "datePublished": "2026-04-27T17:45:13.740Z", "dateUpdated": "2026-04-29T13:57:58.377Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-27T17:45:13.740Z"}, "title": "mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "Authorization Bypass"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "mettle", "product": "sendportal", "versions": [{"version": "3.0.0", "status": "affected"}, {"version": "3.0.1", "status": "affected"}], "modules": ["Invitation Handler"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php of the component Invitation Handler. This manipulation of the argument invitation causes authorization bypass. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-26T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-26T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-26T21:58:38.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "B1scuit (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359744", "name": "VDB-359744 | mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359744/cti", "name": "VDB-359744 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/801781", "name": "Submit #801781 | mettle sendportal v3.0.1 Insecure direct object reference", "tags": ["third-party-advisory"]}, {"url": "https://github.com/mettle/sendportal/issues/337", "tags": ["issue-tracking"]}, {"url": "https://github.com/mettle/sendportal/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-29T13:57:45.953213Z", "id": "CVE-2026-7145", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-29T13:57:58.377Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7145", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-29T13:57:45.953213Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-29T13:57:52.669Z"}}], "cna": {"title": "mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization", "credits": [{"lang": "en", "type": "reporter", "value": "B1scuit (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:ND/RC:UR"}}], "affected": [{"vendor": "mettle", "modules": ["Invitation Handler"], "product": "sendportal", "versions": [{"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.1"}]}], "timeline": [{"lang": "en", "time": "2026-04-26T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-26T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-26T21:58:38.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359744", "name": "VDB-359744 | mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359744/cti", "name": "VDB-359744 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/801781", "name": "Submit #801781 | mettle sendportal v3.0.1 Insecure direct object reference", "tags": ["third-party-advisory"]}, {"url": "https://github.com/mettle/sendportal/issues/337", "tags": ["issue-tracking"]}, {"url": "https://github.com/mettle/sendportal/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php of the component Invitation Handler. This manipulation of the argument invitation causes authorization bypass. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "Authorization Bypass"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-27T17:45:13.740Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7145", "state": "PUBLISHED", "dateUpdated": "2026-04-29T13:57:58.377Z", "dateReserved": "2026-04-26T19:53:34.428Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-27T17:45:13.740Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Invitation Handler"], "product": "sendportal", "vendor": "mettle", "versions": [{"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php of the component Invitation Handler. This manipulation of the argument invitation causes authorization bypass. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha identificado una debilidad en mettle sendportal hasta 3.0.1. Afecta a la funci\u00f3n destroy del archivo app/HTTP/Controllers/Workspaces/WorkspaceInvitationsController.PHP del componente Gestor de Invitaciones. Esta manipulaci\u00f3n del argumento invitation causa un bypass de autorizaci\u00f3n. El ataque puede ser iniciado remotamente. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de problema pero a\u00fan no ha respondido."}], "id": "CVE-2026-7145", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 5.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7145", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-29T13:57:45.953213Z", "version": "2.0.3"}}]}, "published": "2026-04-27T18:16:56.753", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/mettle/sendportal/"}, {"source": "cna@vuldb.com", "url": "https://github.com/mettle/sendportal/issues/337"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/801781"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359744"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359744/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-639"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "sendportal", "source": "cna", "vendor": "mettle"}, "product": "sendportal", "vendor": "mettle"}], "analysis": {"en": {"generated_at": "2026-04-29T01:34:53.608054+00:00", "value": {"mitigation_remediation": ["Apply the latest SendPortal update that addresses the authorization bypass (any release newer than 3.0.1).", "If no patch is available, restrict the destroy endpoint to users with administrative roles and enforce a strict role check before processing the invitation.", "In lieu of a patch or role restriction, add a server\u2011side verification in WorkspaceInvitationsController to confirm that the invitation belongs to the workspace of the authenticated user before allowing deletion.", "Review action logs for unauthorized delete attempts and monitor workspace invitation activity for anomalies."], "summary": {"action": "Patch Immediately", "impact": "Authorization bypass leading to unauthorized deletion of workspace invitations"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the SendPortal application developed by mettle, in all releases up to and including version 3.0.1. No specific sub\u2011versions beyond that were identified; therefore any installation of SendPortal 3.0.1 or earlier is susceptible.", "description_and_impact": "A weakness in the destroy function of WorkspaceInvitationsController allows manipulation of the invitation argument to bypass authorization checks. This flaw enables an attacker to delete workspace invitations without the required permissions, potentially exposing sensitive information or disrupting collaboration. The underlying causes map to authorization weaknesses (CWE-285) and user\u2011controlled key bypass (CWE-639).", "risk_and_exploitability": "The CVSS score of 5.3 classifies the issue as moderate. The EPSS score of 0.00036 (<1%) indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack can be initiated remotely by sending a crafted request to the destroy endpoint with a manipulated invitation parameter. Once exploited, the attacker can delete workspace invitations, which may lead to denial of collaboration or unintended disclosure of invitation details."}}}}, "created": "2026-04-28T09:16:59.897772+00:00", "title": "Authorization Bypass Enables Unauthorized Deletion of Workspace Invitations in SendPortal", "updated": "2026-04-29T01:45:26.016179+00:00", "vendors": ["mettle", "mettle$PRODUCT$sendportal"]}