{"id":"CVE-2026-119732","published":"2026-11-02T19:18:01.870","lastModified":"2026-11-02T19:35:33.347","description":"Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://medium.com/@TheWildEye/bola-in-munshi-sub-users-could-delete-the-tenant-owners-invoices-008f4331c339","tags":[]},{"url":"https://www.petpooja.com/","tags":[]},{"url":"https://www.vulncheck.com/advisories/munshi-broken-object-level-authorization-via-invoice-deletion-api","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}