CVE-2026-119734

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...