Cpe:2.3:a:petpooja:munshi:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apetpoojamunshi/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 19:48:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMunshi: Missing authorization in company deletion (CVE-2026-119733)https://feed.craftedsignal.io/briefs/2026-11-munshi-auth-bypass/Mon, 02 Nov 2026 19:48:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-munshi-auth-bypass/An authorization vulnerability in the Munshi company deletion workflow allows authenticated sub-users to permanently delete company records and associated data without the required permissions.Munshi by Petpooja versions prior to 2026-07-07 contain a missing authorization vulnerability in the DELETE /api/companies/{company_id} endpoint. The application fails to validate the company_delete permission or verify company ownership during the deletion process. An authenticated sub-user with minimal access can exploit this flaw to execute a hard delete of a company record, resulting in irreversible data loss, including invoices, configurations, and chat sessions.

Impact

Exploitation leads to permanent, irreversible deletion of business data, including financial records, system configurations, and historical communications.

Recommendation

  • Upgrade Munshi to the version released on 2026-07-07 or later to implement proper authorization checks on the company deletion API.
  • Review access control lists for all sub-user accounts to identify accounts with excessive or unnecessary permissions.
  • Audit administrative access logs for the deletion endpoint to ensure no unauthorized records have been purged.
]]>highadvisory