What is CVE-2026-119731 in Munshi?
CVE-2026-119731 is a high-severity payment bypass vulnerability affecting Munshi vulnerabilidad crítica CVE-2026-115905 developed by Petpooja. The flaw exists in the subscription payment webhook located at POST /api/payment/order/webhook.
The endpoint lacks basic security controls such as webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. This security oversight resembles permissions issues seen in other software like CVE-2026-58946 and CVE-2026-58957.
Who is affected and how does the attack work?
A remote, unauthenticated attacker can exploit this endpoint by submitting a forged payment-success notification referencing an order obtained from the payment-status redirect URL. This tricks the backend system into marking the subscription as paid and active.
As a result, unauthorized users can gain paid access without completing an actual successful payment transaction, undermining the platform revenue model.
How can I protect my webhook endpoints?
Organizations using the affected software must apply patches provided by the vendor before June 30, 2026. Reviewing related advisories on CVE-2026-58957 can also provide insight into secure endpoint handling.
System administrators should follow specific mitigation steps to harden their webhook architecture and prevent forged requests.