CVE-2026-7145

MediumCVSS 5.4/10Last modified Oct 26, 2026

Description

A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php of the component Invitation Handler. This manipulation of the argument invitation causes authorization bypass. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-285 CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Apr 27, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-714508.7Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authe CVE-2026-714515.6- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0 CVE-2026-714527.2- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.CVE-2026-714535.6- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO CVE-2026-714545.8Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 CVE-2026-714555.3Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded Sensitive CVE-2026-714568.5Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue aff CVE-2026-714585.0URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 s CVE-2026-714595.0JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through CVE-2026-71467.3A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by t CVE-2026-714604.3/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sk CVE-2026-714614.3HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers