CVE-2026-7145: Mettle SendPortal Auth Bypass Vulnerability

CVE-2026-7145 Overview

An authorization bypass vulnerability has been identified in Mettle SendPortal up to version 3.0.1. The vulnerability affects the destroy function within the app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php file, which is part of the Invitation Handler component. By manipulating the invitation argument, an attacker can bypass authorization controls. This weakness can be exploited remotely over the network by authenticated users with low privileges.

Critical Impact
Authenticated attackers can bypass authorization controls to manipulate workspace invitations, potentially allowing unauthorized deletion of invitations or interference with workspace membership management.

Affected Products

Mettle SendPortal up to version 3.0.1
SendPortal Invitation Handler component
WorkspaceInvitationsController.php

Discovery Timeline

2026-04-27 - CVE-2026-7145 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-7145

Vulnerability Analysis

This vulnerability is classified as CWE-285: Improper Authorization. The flaw resides in the invitation handling mechanism of SendPortal's workspace management functionality. When processing requests to the destroy function, the application fails to properly validate whether the authenticated user has the appropriate authorization to perform the requested action on the specified invitation resource.

The authorization bypass allows users with legitimate but limited access to the application to manipulate invitation objects that should be outside their access scope. This represents a broken access control issue where the application does not adequately verify that the requesting user has permission to delete a particular invitation.

The vulnerability is exploitable remotely over the network, requiring only low-privilege authentication. No user interaction is required for exploitation. While the confidentiality impact is none, attackers can achieve low-level impacts to both integrity and availability of the invitation management system.

Root Cause

The root cause stems from improper authorization checks in the destroy function of WorkspaceInvitationsController.php. The application accepts the invitation parameter without sufficiently validating that the authenticated user has ownership or administrative rights over that specific invitation resource. This allows an authenticated user to reference and delete invitations belonging to other workspaces or users.

Attack Vector

The attack vector is network-based, requiring an authenticated user with low privileges. An attacker who has valid credentials for the SendPortal application can craft requests to the invitation destroy endpoint while manipulating the invitation identifier. By iterating through or guessing valid invitation IDs, the attacker can delete invitations that they should not have access to, potentially disrupting workspace collaboration or preventing legitimate users from accepting their invitations.

The attack does not require any user interaction and can be automated to systematically target invitation resources across the application.

Detection Methods for CVE-2026-7145

Indicators of Compromise

Unexpected deletion of workspace invitations that were not performed by authorized administrators
Elevated activity on the /workspaces/*/invitations/*/destroy endpoint from low-privilege accounts
Log entries showing invitation deletion requests for invitations outside the authenticated user's workspace scope

Detection Strategies

Monitor application logs for DELETE requests to the WorkspaceInvitationsController destroy endpoint
Implement logging to capture the relationship between the authenticated user and the target invitation resource
Set up alerts for users attempting to access or delete invitations across multiple workspace IDs in rapid succession

Monitoring Recommendations

Enable detailed access logging for the invitation management endpoints
Implement rate limiting on invitation-related API endpoints to slow enumeration attacks
Review audit trails for invitation deletions that do not correlate with expected administrative activity

How to Mitigate CVE-2026-7145

Immediate Actions Required

Review and audit all recent invitation deletions in affected SendPortal instances
Implement additional authorization checks at the application layer to validate user permissions before processing invitation operations
Consider temporarily restricting access to the invitation management functionality until a patch is available

Patch Information

As of the last update, the vendor (Mettle) has been informed of this vulnerability through an issue report on GitHub but has not yet responded or released an official patch. Organizations using SendPortal should monitor the SendPortal GitHub repository for security updates.

Additional technical details about this vulnerability are available through VulDB.

Workarounds

Implement a web application firewall (WAF) rule to validate that invitation destroy requests only target resources owned by the requesting user's workspace
Add server-side authorization middleware to verify workspace membership before processing invitation operations
Consider disabling the invitation deletion feature for non-administrator roles until an official patch is released
Restrict network access to the SendPortal application to trusted IP ranges where possible

bash

# Example: Add authorization validation middleware (Laravel)
# In WorkspaceInvitationsController.php, add to the destroy method:
# Verify the invitation belongs to a workspace the user can manage
# $this->authorize('delete', $invitation);