Threats tagged 'ghsa-jrw2-g2pp-rv96'

Munshi (by Petpooja) versions before 2026-07-07 have a missing authorization vulnerability in the company deletion API endpoint. This flaw allows an authenticated invited sub-user with access to a company to delete the company record without proper permission checks. The deletion is hard and irreversible, resulting in loss of critical business data such as invoices, configurations, and chat sessions.