CVE-2026-119732

CVSS 7.1 (high) · published 2026-11-02

Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.

Weakness: CWE-639

Source: NVD CVE-2026-119732

References

• https://medium.com/@TheWildEye/bola-in-munshi-sub-users-could-delete-the-tenant-owners-invoices-008f4331c339
• https://www.petpooja.com/
• https://www.vulncheck.com/advisories/munshi-broken-object-level-authorization-via-invoice-deletion-api

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.