{"id":"CVE-2026-119734","published":"2026-11-02T19:18:02.203","lastModified":"2026-11-02T19:35:33.347","description":"Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can modify the thread ID to read supplier communication and quotation-related content belonging to other users, resulting in unauthorized disclosure of sensitive business information outside their access scope.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://medium.com/@TheWildEye/idor-in-munshi-changing-a-purchase-inquiry-id-exposed-another-users-thread-540323a91bf5","tags":[]},{"url":"https://www.petpooja.com/","tags":[]},{"url":"https://www.vulncheck.com/advisories/munshi-idor-via-purchase-inquiry-thread-endpoint","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}