CVE-2026-7145
mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization
Résumé
mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php of the component Invitation Handler. This manipulation of the argument invitation causes authorization bypass. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory vuldb.com
- advisory vuldb.com
- report github.com
- report vuldb.com
- web github.com