CVE-2026-119732
mediumMunshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belon…
Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://medium.com/@TheWildEye/bola-in-munshi-sub-users-could-delete-the-tenant-owners-inv... disclosure@vulncheck.com
- https://www.petpooja.com/ disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/munshi-broken-object-level-authorization-via-invoice-... disclosure@vulncheck.com