Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119733— Munshi Missing Authorization in Company Deletion API

Quick assessment

Affected
Petpooja Munshi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 2026 年 7 月 7 日之前，Munshi（由 Petpooja 开发）在删除公司的流程中存在授权缺失漏洞，具体位于 接口。该应用未能强制执行专用的 权限，也未验证请求者是否为公司的所有者。已认证的受邀子用户即使仅拥有对某公司的基本访问权限，也可利用此漏洞执行该公司的硬删除操作，导致与该关联的业务数据（包括发票、配置和聊天会话等）发生不可逆的丢失。

CVSS 8.1 · High EPSS 0.33% · P26

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 1

VendorProduct Version RangeStatus
Petpooja Munshi ≤ 2026-07-07 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119733

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Munshi Missing Authorization in Company Deletion API
Source: CVE Program / CVE List V5
Vulnerability Description
Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Petpooja Munshi 0 ~ 2026-07-07 -

II. Public POCs for CVE-2026-119733

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119733

请登录查看更多情报信息。

Other References for CVE-2026-119733 (3)

Same Patch Batch · Petpooja · 2026-11-02 · 6 CVEs total

CVE-2026-119736 8.2 HIGH Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials
CVE-2026-119731 7.5 HIGH Munshi Payment Bypass via Unauthenticated Webhook Endpoint
CVE-2026-119734 6.5 MEDIUM Munshi IDOR via Purchase Inquiry Thread Endpoint
CVE-2026-119732 6.5 MEDIUM Munshi Broken Object Level Authorization via Invoice Deletion API
CVE-2026-119735 5.4 MEDIUM Munshi XSS via Purchase Inquiry Thread Rendering

IV. Related Vulnerabilities

Same product: Munshi
Same vendor: Petpooja
Same weakness: CWE-862