Threats tagged 'ghsa-c23v-w858-x95x'

Munshi (by Petpooja) versions before 2026-07-28 have a broken object level authorization vulnerability. Authenticated sub-users can delete invoices belonging to the tenant owner by exploiting insufficient permission checks on DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints. These endpoints verify only tenant membership but do not enforce ownership or permission checks, allowing unauthorized deletion of invoices.