Live › vulnerability › CVE-2026-119734
Munshi by Petpooja has a broken object-level authorization flaw in its purchase-inquiry thread endpoint. A logged-in user can change the thread ID and read supplier communication and quotation content belonging to other users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Teams that use Munshi by Petpooja with multiple user accounts that handle supplier purchase inquiries. The exposure requires a valid account, since an attacker must be authenticated before changing the thread identifier. Organizations running only a single account or not using this product can skip it.
No product ranges from the sources yet.
2026-06-17; the sources say versions before that date are affected.2026-06-17 or later, per the NVD description.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can modify the thread ID to read supplier communication and quotation-related content belonging to other users, resulting in unauthorized disclosure of sensitive business information outside their access scope.
This page as .md · .json · in your agent: get_signal("CVE-2026-119734")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.