CVE-2026-119732

MEDIUM 6.5

Munshi Broken Object Level Authorization via Invoice Deletion API

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.

CWE	CWE-639
Vendor	petpooja
Product	munshi
Published	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for petpooja munshi

Be the first to know when new medium vulnerabilities affecting petpooja munshi are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

Petpooja / Munshi

0 ≤ 2026-07-28

References

NVD ↗ CVE.org ↗ EPSS Data ↗

medium.com: https://medium.com/@TheWildEye/bola-in-munshi-sub-users-could-delete-the-tenant-owners-invoices-008f4331c339 petpooja.com: https://www.petpooja.com/ vulncheck.com: https://www.vulncheck.com/advisories/munshi-broken-object-level-authorization-via-invoice-deletion-api

Credits

Vyom Nagpal