Munshi, a point‑of‑sale platform by Petpooja, contained an object‑level authorization flaw in the /purchase‑inquiry/thread/{thread-id} endpoint. The flaw allows an authenticated user to alter the thread identifier and read supplier communication and quotation data that belong to another user. This results in the accidental exposure of confidential business information beyond the attacker’s authorized scope.

The vulnerability affects Petpooja’s Munshi product deployed in any version before 2026‑06‑17. Users of earlier releases are susceptible if they have valid credentials to access the Purchase Inquiry Thread API.

The CVSS score is 7.1, indicating a high severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated, so it can occur only after a user has logged in. The attacker can then manipulate the numeric thread identifier to retrieve another user's data. As the flaw is an authorization issue (CWE‑639), it poses a significant risk of data disclosure for sensitive business operations.