CVE-2026-119732

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...