Auth bypass in Petpooja Munshi
CVE-2026-119733
Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- medium.com/@TheWildEye/a-sub-user-could-delete-a-company-in-munshi-94bf92476e5c (technical-description, exploit)
- www.petpooja.com/ (product)
- www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-a… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-119733?
- CVE-2026-119733 is a high-severity vulnerability in Petpooja Munshi, classified under Missing Authorization. CVSS score: 8.1/10. Published 2026-11-02.
- How severe is CVE-2026-119733?
- High severity. CVSS v3 base score is 8.1 out of 10.