CVE-2026-119733
Last modified
CVE-2026-119733 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions..
Description
Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Petpooja | Munshi | <= 2026-07-07 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-119733?
How severe is CVE-2026-119733?
How do I fix CVE-2026-119733?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-119728A flaw was found in the H.264 video parser in gst-plugins-ba…6.5
- CVE-2026-119729A flaw was found in GStreamer. An integer overflow vulnerabi…6.5
- CVE-2026-11973The WP-Lister Lite for eBay plugin for WordPress is vulnerab…4.9
- CVE-2026-119730Maxthon Browser for Android before 7.5.8.103 contains an add…4.3
- CVE-2026-119731Munshi (by Petpooja) before 2026-06-30 contained a payment b…7.5
- CVE-2026-119732Munshi (by Petpooja) before 2026-07-28 contained a broken ob…6.5
- CVE-2026-119734Munshi (by Petpooja) before 2026-06-17 contained a broken ob…6.5
- CVE-2026-119735Munshi (by Petpooja) before 2026-07-13 contained a stored cr…5.4
- CVE-2026-119736Attendo (formerly Petpooja Payroll) Admin Android applicatio…8.2
- CVE-2026-119737The pppoe_wrapper vendor daemon from the Amlogic Android SDK…7.8
- CVE-2026-119738The VobSub subtitle decoder libsub_vob (part of the Amlogic …5.3
- CVE-2026-119739The VobSub subtitle decoder libsub_vob (part of the Amlogic …5.3
Are you affected by CVE-2026-119733?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST