PT-2026-35500 · Mettle · Sendportal

B1Scuit · CVE-2026-7145 · Published 2026-04-27 · Updated 2026-04-28

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions mettle sendportal versions prior to 3.0.2

Description An authorization bypass exists in the Invitation Handler component. A remote attacker can manipulate the invitation argument within the destroy() function of the 'app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php' file to bypass authorization controls.

Recommendations Update to a version newer than 3.0.1. As a temporary workaround, restrict access to the destroy() function in the 'app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php' file.

Exploit

Fix

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

CVE-2026-7145

Affected Products

Sendportal

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7145.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-7145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7145 · Security Note
• https://github.com/mettle/sendportal/issues/337 · Note
• https://twitter.com/VulmonFeeds/status/2048963000732701080 · Twitter Post
• https://github.com/mettle/sendportal · Note
• https://vuldb.com/vuln/359744 · Note
• https://twitter.com/CVEnew/status/2048852116941279711 · Twitter Post
• https://vuldb.com/vuln/359744/cti · Note
• https://vuldb.com/submit/801781 · Note