high · CVSS v3 8.1 · CVSS v4 7.2

CVE-2026-119733

Munshi's company deletion endpoint lacks proper authorization checks, allowing an authenticated sub-user to permanently delete a company. Th

Overview

Munshi's company deletion endpoint lacks proper authorization checks, allowing an authenticated sub-user to permanently delete a company. This flaw can lead to irreversible loss of business data such as invoices, configurations, and chat sessions. The vulnerability is present in the DELETE /api/companies/{company_id} endpoint.

Description

Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.

Impact

Confidentiality: company data is lost. Integrity: data is removed. Availability: critical business information becomes unavailable. Impacted parties include sub-users with company access, administrators, and customers relying on the data.

Remediation

Apply the vendor patch that enforces the company_delete permission. If a patch is not yet available, restrict sub-user permissions to read-only or remove them from the company. Monitor DELETE /api/companies logs for anomalous activity. Use an API gateway or WAF to block unauthorized delete requests.

Risk context

The vulnerability has a high severity rating (CVSS v3 8.1) and poses an urgent risk of irreversible data loss. Defenders should prioritize patching or mitigation immediately.

Affected products

  • Munshi

Scores

Severity
high
CVSS v2
8.5
CVSS v3
8.1
CVSS v4
7.2
EPSS
—

authorization privilege_escalation data_loss API Munshi high_severity

← All CVEs

Related CVEs

high

CVE-2026-119301

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

View analysis

high

CVE-2026-120830

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.

View analysis

high

CVE-2026-120833

Labbench versions prior to 0.46.1 deserialize untrusted .p or .pickle files using pandas.read_pickle, enabling arbitrary code execution when a user loads such files. The flaw allows attackers to run malicious code on the host system. It is a high‑severity vulnerability that can compromise confidentiality, integrity, and availability of affected installations.

View analysis

high

CVE-2026-107441

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

View analysis