Munshi: Missing authorization in company deletion (CVE-2026-119733)
An authorization vulnerability in the Munshi company deletion workflow allows authenticated sub-users to permanently delete company records and associated data without the required permissions.
CVE search metadata
CVE search record: CVE-2026-119733. Severity: high. CVSS: 8.1. KEV: no. Product: Munshi (< 2026-07-07). Brief: Munshi: Missing authorization in company deletion (CVE-2026-119733). Brief link: https://feed.craftedsignal.io/briefs/2026-11-munshi-auth-bypass/
Triage facts
Revision 1- Applicability
- Munshi (< 2026-07-07)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 2, 19:48 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Munshi by Petpooja versions prior to 2026-07-07 contain a missing authorization vulnerability in the DELETE /api/companies/{company_id} endpoint. The application fails to validate the company_delete permission or verify company ownership during the deletion process. An authenticated sub-user with minimal access can exploit this flaw to execute a hard delete of a company record, resulting in irreversible data loss, including invoices, configurations, and chat sessions.
Impact
Exploitation leads to permanent, irreversible deletion of business data, including financial records, system configurations, and historical communications.
Recommendation
- Upgrade Munshi to the version released on 2026-07-07 or later to implement proper authorization checks on the company deletion API.
- Review access control lists for all sub-user accounts to identify accounts with excessive or unnecessary permissions.
- Audit administrative access logs for the deletion endpoint to ensure no unauthorized records have been purged.
Immediate actions
Upgrade Munshi to version released on 2026-07-07 or later
Threat Hunt
Audit API logs for DELETE requests to /api/companies/{company_id} originating from non-administrative sub-user accounts
Data: Web server access logs, Application authorization audit logs
Mitigations
Apply patch released 2026-07-07
CVE-2026-119733