CVE-2026-119734
Medium · 6.5CVSS
6.5
EPSS
0.2%
Published
Nov 2, 2026
CISA due date
—
The record
Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can modify the thread ID to read supplier communication and quotation-related content belonging to other users, resulting in unauthorized disclosure of sensitive business information outside their access scope.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121734 ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows… CWE-639
- CVE-2026-121732 RosarioSIS before 12.9 contains an improper authorization vulnerability that allows… CWE-639
- CVE-2026-121582 A vulnerability has been found in Umami up to 3.4.1. CWE-639
- CVE-2026-116669 Tanium addressed an improper access controls vulnerability in Discover. CWE-639
- CVE-2026-121631 Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the… CWE-639
- CVE-2026-115292 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can… CWE-639
- CVE-2026-115295 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to… CWE-639
- CVE-2026-121560 LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that… CWE-639