CVE-2026-119733

Munshi by Petpooja before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/companyid, where the application fails to enforce the dedicated companydelete permission or verify company ownership. An authenticated invited sub-user wi...