---
id: CVE-2026-119734
title: Munshi IDOR via Purchase Inquiry Thread Endpoint
summary: >-
  Munshi (by Petpooja) before 2026-06-17 contained a broken object level
  authorization vulnerability that allows authenticated attackers to access
  another user's purchase inquiry by manipulating the thread identifier in the
  GET /purchase-i…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Petpooja
product: Munshi
affected:
  - Munshi <= 2026-06-17
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T18:58:31.208Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119734'
references:
  - url: >-
      https://medium.com/@TheWildEye/idor-in-munshi-changing-a-purchase-inquiry-id-exposed-another-users-thread-540323a91bf5
    label: Researcher Disclosure
  - url: 'https://www.petpooja.com/'
    label: Vender Homepage
  - url: >-
      https://www.vulncheck.com/advisories/munshi-idor-via-purchase-inquiry-thread-endpoint
    label: 'VulnCheck Advisory: Munshi IDOR via Purchase Inquiry Thread Endpoint'
tags:
  - cve.org
epss: 0.00235
epssPercentile: 0.14503
ingestedAt: '2026-11-05T19:30:42.782Z'
---

## Overview

Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can modify the thread ID to read supplier communication and quotation-related content belonging to other users, resulting in unauthorized disclosure of sensitive business information outside their access scope.

## Affected

- `Munshi <= 2026-06-17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.