A weakness in the destroy function of WorkspaceInvitationsController allows manipulation of the invitation argument to bypass authorization checks. This flaw enables an attacker to delete workspace invitations without the required permissions, potentially exposing sensitive information or disrupting collaboration. The underlying causes map to authorization weaknesses (CWE-285) and user‑controlled key bypass (CWE-639).

The vulnerability affects the SendPortal application developed by mettle, in all releases up to and including version 3.0.1. No specific sub‑versions beyond that were identified; therefore any installation of SendPortal 3.0.1 or earlier is susceptible.

The CVSS score of 5.3 classifies the issue as moderate. The EPSS score of 0.00036 (<1%) indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack can be initiated remotely by sending a crafted request to the destroy endpoint with a manipulated invitation parameter. Once exploited, the attacker can delete workspace invitations, which may lead to denial of collaboration or unintended disclosure of invitation details.