Authorization Flaw in Munshi App by Petpooja

CVE-2026-119733

What is CVE-2026-119733?

The Munshi application, developed by Petpooja, is affected by a vulnerability that allows authenticated sub-users to delete a company record without proper authorization checks. This critical flaw exists in the company deletion workflow, specifically at the DELETE /api/companies/{company_id} endpoint, where the application neglects to enforce the necessary permissions or verify company ownership. Consequently, an invited sub-user with basic access can exploit this vulnerability, leading to irreversible deletion of crucial business data, including invoices, configurations, and chat histories, posing significant risks to business operations.

References