CVE-2026-119734

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

CVE-2026-119732

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...

EUVD-2026-115365

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

CVE-2026-119732 Munshi Broken Object Level Authorization via Invoice Deletion API

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...

EUVD-2026-115363

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...

CVE-2026-119732

The Munshi application by Petpooja (versions prior to 2026-07-28) is vulnerable to a broken object level authorization (BOLA) flaw. The vulnerability exists because the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints verify tenant membership but fail to enforce objec...

PT-2026-135641

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoice id and POST /api/invoices/bulk-delete endpoints, which only verify...

CVE-2026-119732: Petpooja Munshi: Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows…

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...

PT-2026-135643

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

CVE-2026-119734: Petpooja Munshi: Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows…

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

web-vuln-labs

web-vuln-labs Small, deliberately vulnerable web apps. Each l...

CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

CVE-2026-72001 — Pangolin Cross-Organization Resource Authentication Bypass Proof-of-concept for CVE-2026-72001 , a broken-object-level-authorization flaw in Pangolin 1.22.0 that lets the holder of one resource share link mint a valid resource session for any other resource on the instance...

CVE-2026-100105

A flaw was found in Grafana. An authenticated user with permission to edit alert contact points can bypass field-level authorization restrictions by switching an integration to a legacy schema version. This flaw allows the user to alter protected settings such as destination URLs, potentially...

CVE-2026-24134-PoC

CVE-2026-24134-PoC Overview This repository contains the Proof of Concept PoC for CVE-2026-24134 , a Broken Object Level Authorization BOLA vulnerability in StudioCMS. Contents cve202624134poc.py - Python exploitation script Prerequisites StudioCMS=0.1.1 pip install requests colorama Quick Start...

CVE-2026-35045-PoC

CVE-2026-35045 — Broken Object-Level Authorization in Tandoor Recipes Summary The PUT /api/recipe/batchupdate/ endpoint in Tandoor Recipes v2.6.1 allows any authenticated user within a Space to modify any recipe in that Space — including private recipes owned by other users. This completely...

CVE-2026-63338 IXP Manager has Broken Object-Level Authorization

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in ApiKeyController selects records by identifier without...

CVE-2026-63338

Prior to version 7.3.0 , IXP Manager (a web application for Internet Exchange Points) is vulnerable to an authorization bypass issue. The ApiKeyController 's edit/update path fails to verify that the user_id matches the caller when selecting records by identifier. This allows an authenticated use...

CVE-2026-63338 IXP Manager has Broken Object-Level Authorization

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in ApiKeyController selects records by identifier without...

CVE-2025-12523

Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user...

CVE-2026-82073

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...