Live › vulnerability › CVE-2026-119731
Munshi, a restaurant software product by Petpooja, has a subscription payment webhook that does not verify where its notifications come from. An unauthenticated attacker can send a fake payment-success message and get paid access without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Restaurants and businesses that use Munshi with subscription billing are exposed, because the flawed webhook sits on the payment path of the product. Teams that only use Munshi through a vendor-hosted service should ask the vendor whether their instance was on a fixed build. The sources do not say which deployment models are affected beyond the stated version range.
No product ranges from the sources yet.
POST /api/payment/order/webhook in the Munshi backend2026-06-30 are affected; move to a build dated 2026-06-30 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.
This page as .md · .json · in your agent: get_signal("CVE-2026-119731")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.