Munshi Missing Authorization in Company Deletion API
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Proof of concept public, per CISA
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects Munshi versions before 2026-07-07 (Affecting Munshi <= 2026-07-07). Attacker must be an authenticated invited sub-user with access to the company.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 35/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
Munshi, a business software product from Petpooja, contained a flaw in its company deletion feature that let invited sub-users with access to a company permanently delete it without the required delete permission or ownership check. This could result in irreversible loss of that company's business data, such as invoices, configurations, and chat sessions.
Read the original description
Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.
What to do
Check whether your setup matches what the bug needs.
Affects Munshi versions before 2026-07-07 (Affecting Munshi <= 2026-07-07). Attacker must be an authenticated invited sub-user with access to the company.Workaround: The checked facts do not list a workaround or fix. Limiting which sub-users have access to company records is the only step the facts point toward, and it should be confirmed with the vendor.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Petpooja Munshi
through 2026-07-07
Evidence 3
- Exploit
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-119733
What does this mean?
The Company Deletion API in Munshi does not check whether a user is allowed to delete a company. An invited sub-user who has access to a company can permanently delete that company record, which removes its associated business data such as invoices, configurations, and chat sessions, and this cannot be reversed.Source: vulncheck.com
Am I affected, and how do I check?
The facts list Munshi from the first version through 2026-07-07 as affected. To check a Munshi installation, look at its version and compare it with that date; the facts do not name a specific version string or setting to inspect.Source: vulncheck.com
What should I do about it?
No fixed version is listed in the checked facts, so the facts do not name an upgrade target. Check the vendor's advisory for a patched release.Source: vulncheck.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts do not list a workaround or fix. Limiting which sub-users have access to company records is the only step the facts point toward, and it should be confirmed with the vendor.Source: vulncheck.com