---
id: CVE-2026-119733
title: Munshi Missing Authorization in Company Deletion API
summary: >-
  Munshi (by Petpooja) before 2026-07-07 contained a missing authorization
  vulnerability in its company deletion workflow at DELETE
  /api/companies/{company_id}, where the application fails to enforce the
  dedicated company_delete permission…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-862
vendor: Petpooja
product: Munshi
affected:
  - Munshi <= 2026-07-07
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T19:50:25.130692Z'
exploitAvailable: true
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T19:50:35.888Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119733'
references:
  - url: >-
      https://medium.com/@TheWildEye/a-sub-user-could-delete-a-company-in-munshi-94bf92476e5c
    label: Researcher Disclosure
  - url: 'https://www.petpooja.com/'
    label: Vender Homepage
  - url: >-
      https://www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-api
    label: 'VulnCheck Advisory: Munshi Missing Authorization in Company Deletion API'
tags:
  - cve.org
  - exploit-available
epss: 0.00331
epssPercentile: 0.26377
ingestedAt: '2026-11-05T19:30:42.814Z'
---

## Overview

Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.

## Affected

- `Munshi <= 2026-07-07`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.