mettle SendPortal EUVD-2026-25896

Q: What is the CVSS score of EUVD-2026-25896?

EUVD-2026-25896 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7145 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-27 VulDB

PHP Authentication Bypass Sendportal Mettle

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable IDOR requiring authenticated low-privilege access; limited integrity and availability impact from unauthorized invitation deletion, no confidentiality loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:06 vuln.today

CVSS changed

Apr 27, 2026 - 18:22 NVD

5.4 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 18:00 euvd

EUVD-2026-25896

CVE Published

Apr 27, 2026 - 17:45 nvd

MEDIUM 5.3

DescriptionCVE.org

A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php of the component Invitation Handler. This manipulation of the argument invitation causes authorization bypass. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Authorization bypass in SendPortal's workspace invitation handler allows authenticated low-privilege users to delete workspace invitations they do not own by manipulating the invitation identifier in the destroy endpoint. Versions 3.0.0 and 3.0.1 are confirmed affected per EUVD-2026-25896. The vendor has not responded to responsible disclosure; no patch is available, no public exploit code exists, and no active exploitation has been confirmed (not in CISA KEV), making this a low-urgency finding with limited blast radius.

Technical ContextAI

SendPortal is an open-source PHP-based email marketing and campaign management platform developed by mettle. The vulnerability is located in app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php, specifically the destroy method, which handles deletion of workspace invitations. CWE-639 (Authorization Bypass Through User-Controlled Key) identifies this as an Insecure Direct Object Reference (IDOR) pattern: the application uses a caller-supplied invitation identifier to look up and delete the target record without verifying that the authenticated requester has ownership or administrative rights over that specific invitation object. This is a common flaw in Laravel-based applications where resource authorization is not enforced at the policy or gate layer. The CPE cpe:2.3:a:mettle:sendportal:*:*:*:*:*:*:*:* covers all versions, with EUVD explicitly confirming 3.0.0 and 3.0.1.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor has not responded to the GitHub issue report at https://github.com/mettle/sendportal/issues/337 as of the disclosure timeline described. As a compensating control, administrators should restrict workspace invitation creation and management permissions to the minimum required user roles, reducing the pool of authenticated users who can reach the destroy endpoint. Auditing HTTP server logs for anomalous DELETE requests targeting invitation IDs not associated with the requesting user can surface exploitation attempts. If the workspace invitation feature is not operationally required, disabling it at the application or web server routing level is the most effective mitigation, with the trade-off of preventing new member onboarding via invitations. Monitor https://github.com/mettle/sendportal/ and https://vuldb.com/vuln/359744 for patch availability.