---
id: "CVE-2026-119733"
kind: "vulnerability"
aliases: ["CVE-2026-119733"]
title: "Munshi by Petpooja: invited sub-users can hard-delete company records"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Munshi", "fixed": ["2026-07-07"], "affected": "<= 2026-07-07", "ecosystem": "vendor"}]
ecosystems: []
tags: ["missing-authorization", "munshi", "other", "petpooja", "restaurants", "saas"]
not_affected_if: ["no-munshi-use", "no-sub-users"]
published_at: "2026-11-02T19:18:02+00:00"
first_seen_at: "2026-11-02T19:24:39+00:00"
updated_at: "2026-11-02T19:27:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119733", "first_seen_at": "2026-11-02T19:24:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T19:27:38+00:00"}]
---

# Munshi by Petpooja: invited sub-users can hard-delete company records

Munshi (Petpooja's restaurant business app) did not check the company_delete permission or company ownership on DELETE /api/companies/{company_id}. Any invited sub-user with access to a company could delete it. VulnCheck and the researcher describe the deletion as permanent, with risk to linked invoices, configurations and chat sessions. The researcher says the linked-record effects are potential, not shown for every record. The researcher's staging test showed a soft-delete marker.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Munshi affected <= 2026-07-07 fixed 2026-07-07

## How to check

Check whether your company uses Munshi by Petpooja and has invited sub-users. Ask Petpooja to confirm the fix is live on your tenant: VulnCheck lists Munshi <= 2026-07-07 as affected, and the researcher reports the issue as fixed. Review who has been invited to your companies and whether any company disappeared unexpectedly.

## Fix

Not stated by the vendor. Researcher reports remediation status Fixed (dated 7 July 2026); VulnCheck says versions before 2026-07-07 are affected. No vendor advisory found. Confirm with Petpooja.

## Timeline

- 2026-11-02T19:24:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119733
- 2026-11-02T19:27:38+00:00 analyst — VulnCheck advisory + researcher (Vyom Nagpal) write-up read. No vendor advisory found; Munshi dev site in maintenance. Versions are dates: affected <= 2026-07-07 per VulnCheck; researcher says Remediation Fixed, dated 7 Jul 2026. Hosted vs dated release unclear; no vendor page, so nothing marked verified. Researcher notes staging used a soft-delete marker while the report says hard delete.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-api
- [describes] A Sub-User Could Delete a Company in Munshi (researcher write-up, sibling issue) https://medium.com/@TheWildEye/a-sub-user-could-delete-a-company-in-munshi-94bf92476e5c

## From the sources

Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_