HIGH 7.1 NVD
CVE-2026-119732
Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belong
Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.
References
- https://medium.com/@TheWildEye/bola-in-munshi-sub-users-could-delete-the-tenant-owners-inv
- https://www.petpooja.com/
- https://www.vulncheck.com/advisories/munshi-broken-object-level-authorization-via-invoice-
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-11-02 via NVD.
vulnfeed aggregates 17711 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.