| tiêu đề | Mettle sendportal v3.0.1 Improper Access Controls |
|---|
| Mô tả | The destroy() method in WorkspaceInvitationsController allows any workspace owner to delete invitations belonging to any other workspace (IDOR - CWE-639).
Vulnerability Details
File: app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php, lines 42-47
public function destroy(Invitation $invitation): RedirectResponse
{
$invitation->delete(); // No workspace ownership check
return redirect()->route('users.index');
}
The route group at routes/web.php line 59 applies OwnsCurrentWorkspace::class middleware, which verifies the user owns their current workspace — but does NOT verify the {invitation} parameter belongs to that workspace. Laravel route model binding resolves ANY invitation by ID. |
|---|
| Nguồn | ⚠️ https://github.com/mettle/sendportal/issues/337 |
|---|
| Người dùng | B1scuit (UID 97177) |
|---|
| Đệ trình | 08/05/2026 07:52 (cách đây 27 ngày) |
|---|
| Kiểm duyệt | 31/05/2026 10:14 (23 days later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 359744 [mettle sendportal đến 3.0.1 Invitation WorkspaceInvitationsController.php destroy invitation nâng cao đặc quyền] |
|---|
| điểm | 0 |
|---|