Broken Object Level Authorization in Munshi by Petpooja
CVE-2026-119734

7.1HIGH

Key Information:

Vendor

Petpooja

Status
Munshi
Vendor
CVE Published:
2 November 2026

What is CVE-2026-119734?

The Munshi platform developed by Petpooja is vulnerable due to a broken object level authorization issue that may allow authenticated users to access private purchase inquiries from other users. By manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint, attackers can gain unauthorized insights into supplier communications and quotations, compromising sensitive business information that should remain confidential.

Affected Version(s)

Munshi 0 <= 2026-06-17

References

https://medium.com/@TheWildEye/idor-in-munshi-changing-a-...
technical-descriptionexploit
https://www.petpooja.com/
product
https://www.vulncheck.com/advisories/munshi-idor-via-purc...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vyom Nagpal
.