Broken Object Level Authorization in Munshi by Petpooja

CVE-2026-119732

What is CVE-2026-119732?

The Munshi software by Petpooja is susceptible to a broken object level authorization issue that permits authenticated sub-users to delete invoices belonging to tenant owners. This vulnerability arises from the inadequacy in the verification process, as the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints merely check tenant membership without enforcing necessary object-level permission checks. As a result, attackers exploit this flaw to issue single or bulk deletion requests using arbitrary invoice identifiers, leading to potential unauthorized data loss within the tenant environment.

References