Munshi, the point-of-sale platform from Petpooja, suffers from a broken object-level authorization flaw in its invoice deletion API. The flaw allows authenticated sub-users to delete any invoice that belongs to the tenant owner, regardless of ownership. Attackers can send DELETE /api/invoice/{invoice_id} or POST /api/invoices/bulk-delete requests with arbitrary invoice identifiers, causing loss of data integrity and potentially exposing or removing sensitive financial records. This vulnerability is categorized as CWE-639.

All installations of Petpooja’s Munshi platform released prior to 2026-07-28 are affected. The flaw impacts the service endpoints that process invoice delete requests; any vendor or reseller deploying the pre-patch version is vulnerable.

The CVSS score of 7.1 indicates a high risk due to substantial impact on confidentiality and integrity. While the EPSS score is not available, the absence of an exploitation list in CISA KEV suggests no publicly known exploits yet. Nonetheless, the flaw is exploitable by any authenticated sub-user with permission to access the API. Attackers only need valid credentials for a sub-user and can issue deletion requests with arbitrary invoice IDs, so the required barrier is entry-level authorization. The vulnerability permits data loss but not arbitrary code execution or privilege escalation beyond the sub-user’s role.