Authorization Bypass in Mettle SendPortal Invitation Handler

CVE-2026-7145

What is CVE-2026-7145?

A weakness has been identified in Mettle SendPortal, specifically within the Invitation Handler component located in the destroy function of the WorkspaceInvitationsController.php file. This vulnerability allows attackers to manipulate invitation arguments, resulting in potential unauthorized access. The vulnerability is exploitable remotely, posing a risk to users who rely on this application for managing workspace invitations. Despite being reported to the project maintainers, there has been no response or remediation yet, leaving systems potentially exposed.

References