{"id":"CVE-2026-119733","kind":"vulnerability","aliases":["CVE-2026-119733"],"related":[],"title":"Munshi by Petpooja: invited sub-users can hard-delete company records","description":"Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.","summary":"Munshi (Petpooja's restaurant business app) did not check the company_delete permission or company ownership on DELETE /api/companies/{company_id}. Any invited sub-user with access to a company could delete it. VulnCheck and the researcher describe the deletion as permanent, with risk to linked invoices, configurations and chat sessions. The researcher says the linked-record effects are potential, not shown for every record. The researcher's staging test showed a soft-delete marker.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Munshi","fixed":["2026-07-07"],"affected":"<= 2026-07-07","ecosystem":"vendor"}],"ecosystems":[],"tags":["missing-authorization","munshi","other","petpooja","restaurants","saas"],"not_affected_if":["no-munshi-use","no-sub-users"],"how_to_check":"Check whether your company uses Munshi by Petpooja and has invited sub-users. Ask Petpooja to confirm the fix is live on your tenant: VulnCheck lists Munshi <= 2026-07-07 as affected, and the researcher reports the issue as fixed. Review who has been invited to your companies and whether any company disappeared unexpectedly.","fix":"Not stated by the vendor. Researcher reports remediation status Fixed (dated 7 July 2026); VulnCheck says versions before 2026-07-07 are affected. No vendor advisory found. Confirm with Petpooja.","status":"open","published_at":"2026-11-02T19:18:02+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","triaged_at":"2026-11-02T19:26:36+00:00","updated_at":"2026-11-02T19:27:38+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-02T19:26:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Munshi by Petpooja: invited sub-users can hard-delete company records","impact":"high","summary":"Munshi, a restaurant business app by Petpooja, let an invited sub-user delete a company record through its API without the required delete permission or ownership check. The deletion is permanent and removes associated invoices, configurations and chat sessions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["munshi","petpooja","restaurants"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker permanently deletes a company and all its business data","analyst_note":"Confirm whether the fix is in a dated release or hosted-only, and whether the vendor has published an advisory beyond the VulnCheck link.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-munshi-use"],"who_is_affected":"Teams that use the hosted Munshi product with invited sub-users. The flaw is in the company deletion endpoint, so any account invited to a company could reach it; the sources do not say which Munshi versions or plans are hosted versus self-run. Teams not using Munshi can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":4205,"output_tokens":465,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the fix is in a dated release or hosted-only, and whether the vendor has published an advisory beyond the VulnCheck link.","search":"'-07':112C,113C '-119733':16A,19A '-2026':15A,18A '/api/companies':47B,126C '2026':111C 'access':56B,152C 'app':34B 'applic':131C 'associ':173C 'authent':145C 'author':23B,117C 'busi':33B,174C 'caus':169C 'chat':79B,180C 'check':37B 'compani':12A,39B,43B,48B,59B,121C,127C,137C,142C,155C,167C 'configur':77B,178C 'contain':114C 'could':60B 'cve':14A,17A 'data':175C 'dedic':136C 'delet':11A,40B,46B,61B,69B,105B,122C,125C,138C,164C 'describ':67B 'effect':88B 'enforc':134C 'everi':94B 'exploit':157C 'fail':132C 'flaw':159C 'hard':10A,163C 'hard-delet':9A 'id':49B,128C 'includ':176C 'invit':4A,51B,146C 'invoic':76B,177C 'irrevers':170C 'link':75B,86B 'linked-record':85B 'loss':171C 'marker':106B 'mere':151C 'miss':22B,116C 'missing-author':21B 'munshi':1A,20A,24B,29B,107C 'ownership':44B,143C 'perform':161C 'perman':71B 'permiss':41B,139C 'petpooja':3A,26B,30B,109C 'potenti':90B 'record':13A,87B,95B,168C 'research':66B,82B,97B 'restaur':27B,32B 'risk':73B 'saa':28B 'say':83B 'session':80B,181C 'show':101B 'shown':92B 'soft':104B 'soft-delet':103B 'stage':99B 'sub':6A,53B,148C 'sub-us':5A,52B,147C 'test':100B 'user':7A,54B,149C 'verifi':141C 'vulncheck':63B 'vulner':118C 'workflow':123C","nicknames":[],"mitigations":[],"who_affected":"Teams that use the hosted Munshi product with invited sub-users. The flaw is in the company deletion endpoint, so any account invited to a company could reach it; the sources do not say which Munshi versions or plans are hosted versus self-run. Teams not using Munshi can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["munshi"],"ptokens":["munshi"],"labels":["high","missingauthorization","munshi","other","petpooja","restaurants","saas"],"first_public_at":"2026-11-02T19:18:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119733","severity":null,"published_at":"2026-11-02T19:18:02+00:00","modified_at":"2026-11-02T19:18:02+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","fetched_at":"2026-11-02T19:24:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119733:1414","url":null,"severity":null,"published_at":"2026-11-02T19:27:38+00:00","modified_at":"2026-11-02T19:27:38+00:00","first_seen_at":"2026-11-02T19:27:38+00:00","fetched_at":"2026-11-02T19:27:38+00:00","note":"VulnCheck advisory + researcher (Vyom Nagpal) write-up read. No vendor advisory found; Munshi dev site in maintenance. Versions are dates: affected <= 2026-07-07 per VulnCheck; researcher says Remediation Fixed, dated 7 Jul 2026. Hosted vs dated release unclear; no vendor page, so nothing marked verified. Researcher notes staging used a soft-delete marker while the report says hard delete."}],"documents":[{"id":53464,"url":"https://www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":53548,"url":"https://medium.com/@TheWildEye/a-sub-user-could-delete-a-company-in-munshi-94bf92476e5c","title":"A Sub-User Could Delete a Company in Munshi (researcher write-up, sibling issue)","kind":"blog","source":"analyst","publisher":null,"text":"Vyom Nagpal write-up of a sibling flaw: DELETE /api/companies/{company_id} checked only company access. Dated 7 July 2026, remediation status Fixed, CVE to be assigned. Product: Munshi by Petpooja; data includes invoices and Tally configurations.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}