CVE WatchNov 2, 2026

CVE-2026-119733

Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/compa

CVSS

8.1

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 2, 2026 · Last modified: Nov 2, 2026 · CWE-862

EPSS · 30d

Not enough EPSS history yet.

Technical description

Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-588738.4 HIG

—

———In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.4h CVE-2026-588668.4 HIG

—

———In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.5h CVE-2026-115654—

—

———In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or re-prioritise application threads and other modules' threads and abort their waits, denying service or changing how the system schedules them.7h CVE-2026-1204297.1 HIG

—

———Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.10h CVE-2026-1203187.2 HIG

—

———Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.7h CVE-2026-1204636.5 MED

—

———Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the `other` document type. Attackers can exploit insufficient authorization checks in the `paperless_search_and_link()` and `serve_paperless_document()` route handlers in file_routes.py to retrieve and disclose private documents belonging to another user via the shared Paperless-ngx API credential, resulting in unauthorized read access and confidentiality loss.7h