Read the docs
TI-2026-83936 Aliases CVE-2026-119731GHSA-hcw8-82qq-9mcv

Payment bypass in Petpooja Munshi via unauthenticated webhook

Priority LOW 37CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Petpooja Munshi before 2026-06-30 has a payment bypass in its subscription payment webhook, which lacks authentication and cryptographic signature verification (CWE-306). A remote, unauthenticated attacker can submit a forged payment-success notification for an order, causing the backend to mark the subscription as paid and grant paid access without a real payment. The references include an exploit link.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.

Why it matters now

EPSS 0.0027 19th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PetpoojaMunshiup to 2026-06-30—No fix listedCNA
  • Munshi VendorPetpooja Affected up to 2026-06-30 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Munshi.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-119731
  2. 2026-11-02 Alias added: GHSA-hcw8-82qq-9mcv
  3. 2026-11-04 Priority changed: MEDIUM → LOW

References

Exploit 1

Other 1

  • TI-2026-83941 Hard-coded MQTT broker credentials in Attendo Admin Android app CVSS 4.0HIGH 8.8
  • TI-2026-83938 Missing authorization in Munshi company deletion API CVSS 4.0HIGH 7.2
  • TI-2026-83939 Authorization bypass in Munshi exposes other users' purchase inquiries CVSS 4.0HIGH 7.1
  • TI-2026-83937 Broken access control in Munshi lets sub-users delete invoices CVSS 4.0HIGH 7.1
  • TI-2026-83940 Stored cross-site scripting in Munshi via Purchase Inquiry thread CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences