Petpooja Munshi company deletion API lacks authorization checks, allowing permanent data loss
Invited sub-users of Munshi can wipe a whole company's data.
Summary
Petpooja Munshi's company deletion feature does not check permissions, so an invited sub-user with access to a company can permanently delete the company record, along with invoices, configurations, and chat sessions. Versions before 2026-07-07 are affected.
Affected when
- An invited sub-user account with access to a company
- Munshi versions before 2026-07-07
What to do
No fixed version is named. Check that the Munshi you use is newer than 2026-07-07, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: medium.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen