Live › vulnerability › CVE-2026-119732
Munshi by Petpooja, a hosted invoice/accounting product, lets an authenticated sub-user delete invoices owned by the tenant owner through DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete. VulnCheck says the endpoints verify only tenant membership, not ownership or permission. Credit: Vyom Nagpal.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Anyone using Munshi by Petpooja who has invited sub-users into a tenant: those users can delete the owner's invoices. VulnCheck lists Munshi up to 2026-07-28 as affected; no fixed version is published. Tenants with only the owner account can skip it. Munshi is a hosted service, so the fix is the vendor's to deploy.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Munshi | vendor | <= 2026-07-28 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.
This page as .md · .json · in your agent: get_signal("CVE-2026-119732")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.