Read the docs
TI-2026-83937 Aliases CVE-2026-119732GHSA-c23v-w858-x95x

Broken access control in Munshi lets sub-users delete invoices

Priority MEDIUM 64CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Munshi by Petpooja before 2026-07-28 contains a broken object level authorization flaw in its invoice deletion API. The DELETE /api/invoice/{invoice_id} endpoint checks only tenant membership and not invoice ownership (CWE-639). An authenticated sub-user with low privileges can delete invoices belonging to the tenant owner, causing unauthorized data loss. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PetpoojaMunshiup to 2026-07-28—No fix listedCNA
  • Munshi VendorPetpooja Affected up to 2026-07-28 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Munshi.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-119732
  2. 2026-11-02 Alias added: GHSA-c23v-w858-x95x
  3. 2026-11-03 CISA SSVC decision points changed

References

Exploit 1

Other 1

  • TI-2026-83941 Hard-coded MQTT broker credentials in Attendo Admin Android app CVSS 4.0HIGH 8.8
  • TI-2026-83938 Missing authorization in Munshi company deletion API CVSS 4.0HIGH 7.2
  • TI-2026-83939 Authorization bypass in Munshi exposes other users' purchase inquiries CVSS 4.0HIGH 7.1
  • TI-2026-83936 Payment bypass in Petpooja Munshi via unauthenticated webhook CVSS 4.0HIGH 8.7
  • TI-2026-83940 Stored cross-site scripting in Munshi via Purchase Inquiry thread CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences