Threats tagged 'ghsa-9453-cwhc-4797'

Munshi (by Petpooja) versions before 2026-06-17 have a broken object level authorization vulnerability. This flaw allows authenticated users to access purchase inquiries of other users by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Exploitation leads to unauthorized disclosure of sensitive supplier communications and quotation information.