Petpooja Munshi CVE-2026-119732

Exploitation requires the attacker to hold a valid, authenticated sub-user account within the target Petpooja Munshi tenant (PR:L); it is not reachable by an unauthenticated outsider. No special non-default configuration, protocol mode, or feature toggle is needed - the flaw is inherent to the default behavior of the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which enforce only tenant membership and omit object-level ownership/permission checks. No user interaction is required (UI:N). The chief limiting factors are the authenticated sub-user prerequisite and the single-tenant blast radius (the attacker can only reach invoices within their own tenant), plus the affected scope being limited to Munshi versions before the 2026-07-28 fix.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N, score 7.1) tells a consistent story: network-reachable, low-complexity, no attack requirement, no user interaction, but requiring low privileges (PR:L) - meaning the attacker must already hold a valid authenticated sub-user account inside the target tenant. Impact is confined to integrity (VI:H) via destruction of invoice records; there is no confidentiality (VC:N) or availability (VA:N) impact and no scope change (SC/SI/SA:N). Cross-referencing the other signals tempers raw severity: no CISA KEV listing, no EPSS score was supplied, and the PoC is a reference (a Medium write-up) that is not verified as working exploit code - so this is not confirmed active exploitation. The vuln.today decision label is 'this_week', not act_now or emergency, which matches a real-but-bounded threat. The practical risk is insider/abuse or compromised-sub-user driven data loss within a single tenant, not mass unauthenticated internet exploitation. Missing data to note: no EPSS probability and no SSVC exploitation/automatable/technical-impact decision values were provided, so automatability cannot be assessed from the input; the authentication prerequisite (PR:L) is the dominant limiting factor.

A legitimate but low-privileged sub-user within a Petpooja Munshi tenant authenticates normally, then issues DELETE /api/invoice/{invoice_id} or POST /api/invoices/bulk-delete requests supplying invoice identifiers belonging to the tenant owner or other users. Because the endpoints check only tenant membership and not object-level ownership, the requests succeed and permanently remove invoices the sub-user does not own. A public PoC reference exists (a Medium article); it is not verified as working exploit code, and no CISA KEV active exploitation is recorded.