CVE-2026-129428

EUVD-2026-125903
Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that allows authenticated viewer-level users to manage approval requests. Attackers can list pending requests to expose proposed commands and targets, and approve or deny other users' requests, altering decision and audit state.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/rcourtman/Pulse
https://github.com/rcourtman/Pulse/blob/v6.7.0/internal/api/ai_handlers.go#L7686
https://github.com/rcourtman/Pulse/commit/f05119d97ea3bc1980886d8c62dda7ce8fd39d4e
https://github.com/rcourtman/Pulse/pull/4127
https://github.com/rcourtman/Pulse/releases/tag/v6.8.0
https://github.com/rcourtman/Pulse/security/advisories/GHSA-9vxw-m79f-gxxr
https://www.vulncheck.com/advisories/pulse-5.0.17-before-6.8.0-missing-authorization-via-ai-assistant-approval-api