Petpooja Munshi CVE-2026-119734

Requires a valid authenticated account on the Petpooja Munshi application (PR:L) with access to the GET /purchase-inquiry/thread/{thread-id} endpoint, plus the ability to guess or enumerate another user's thread identifier (the endpoint performs no ownership check on the thread-id). Affects all versions before the 2026-06-17 fix. Limiting factors that reduce real-world risk: exploitation is not possible unauthenticated, impact is read-only disclosure (no integrity or availability effect), and each request discloses one targeted thread, so bulk harvesting depends on enumerable/predictable thread identifiers.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores this 7.1 (High): network-reachable, low attack complexity, no user interaction, and high confidentiality impact, but it requires low-level privileges (PR:L), meaning a valid authenticated account on the Munshi application. Integrity and availability are unaffected (VI:N/VA:N) - this is a pure information-disclosure (BOLA/IDOR, CWE-639) flaw, so a legitimate but malicious or compromised user can read other tenants' data, not alter or disrupt the system. The real-world priority signals are mixed and mostly moderate: the vuln.today decision label is 'this_week' (not act_now/emergency), the issue is NOT on the CISA KEV list, and no EPSS probability was supplied, so widespread or automated exploitation cannot be quantified from the input. A public PoC reference exists (a Medium write-up) but it is not verified as working exploit code, so this is an exploitability indicator, not confirmation of active exploitation. Net: a genuine authorization defect that is trivial to exploit once authenticated, but the authentication requirement, confidentiality-only impact, and niche product footprint make it a this-week remediation rather than an emergency. Missing data to note explicitly: no EPSS score provided, and KEV status is absent (treat as not-listed), so exploitation-in-the-wild cannot be asserted.

An attacker who holds any valid low-privilege account on the Munshi application sends a GET request to /purchase-inquiry/thread/{thread-id} and substitutes another user's thread identifier. Because the endpoint does not verify that the requesting user owns the thread, the server returns another organization's supplier communications and quotation content. A public PoC reference (a Medium write-up) exists but is not verified as working exploit code.