CVE-2026-119734

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

CVE-2026-119732

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...

EUVD-2026-115365

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

CVE-2026-119732 Munshi Broken Object Level Authorization via Invoice Deletion API

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...

CVE-2026-119732

The Munshi application by Petpooja (versions prior to 2026-07-28) is vulnerable to a broken object level authorization (BOLA) flaw. The vulnerability exists because the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints verify tenant membership but fail to enforce objec...

EUVD-2026-115363

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...

CVE-2026-119732: Petpooja Munshi: Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows…

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...

PT-2026-135641

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoice id and POST /api/invoices/bulk-delete endpoints, which only verify...

PT-2026-135643

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

CVE-2026-119734: Petpooja Munshi: Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows…

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

web-vuln-labs

web-vuln-labs Small, deliberately vulnerable web apps. Each l...

CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

CVE-2026-72001 — Pangolin Cross-Organization Resource Authentication Bypass Proof-of-concept for CVE-2026-72001 , a broken-object-level-authorization flaw in Pangolin 1.22.0 that lets the holder of one resource share link mint a valid resource session for any other resource on the instance...

CVE-2026-63338

Prior to version 7.3.0 , IXP Manager (a web application for Internet Exchange Points) is vulnerable to an authorization bypass issue. The ApiKeyController 's edit/update path fails to verify that the user_id matches the caller when selecting records by identifier. This allows an authenticated use...

CVE-2026-63338 IXP Manager has Broken Object-Level Authorization

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in ApiKeyController selects records by identifier without...

CVE-2026-63338 IXP Manager has Broken Object-Level Authorization

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in ApiKeyController selects records by identifier without...

CVE-2025-12523

Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user...

CVE-2025-12523

Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user...

CVE-2025-12523 Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure

Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user...

CVE-2025-12523

The Centreon Web monitoring system is vulnerable to Broken Object Level Authorization in the Users Configuration Endpoint (/centreon/api/latest/configuration/users). This security flaw allows an authenticated user to bypass access restrictions, potentially leading to the disclosure of sensitive i...

CVE-2025-12523 Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure

Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user...