CVE-2026-129428

MEDIUM 5.4

Pulse 5.0.17 before 6.8.0 Missing Authorization via AI Assistant Approval API

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that allows authenticated viewer-level users to manage approval requests. Attackers can list pending requests to expose proposed commands and targets, and approve or deny other users' requests, altering decision and audit state.

CWE	CWE-862
Vendor	rcourtman
Product	pulse
Published	Nov 14, 2026

Stay Ahead of the Next One

Get instant alerts for rcourtman pulse

Be the first to know when new medium vulnerabilities affecting rcourtman pulse are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

rcourtman / Pulse

5.0.17 < 6.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rcourtman/Pulse/security/advisories/GHSA-9vxw-m79f-gxxr github.com: https://github.com/rcourtman/Pulse/pull/4127 github.com: https://github.com/rcourtman/Pulse/commit/f05119d97ea3bc1980886d8c62dda7ce8fd39d4e github.com: https://github.com/rcourtman/Pulse/blob/v6.7.0/internal/api/ai_handlers.go#L7686 github.com: https://github.com/rcourtman/Pulse/releases/tag/v6.8.0 github.com: https://github.com/rcourtman/Pulse vulncheck.com: https://www.vulncheck.com/advisories/pulse-5.0.17-before-6.8.0-missing-authorization-via-ai-assistant-approval-api

Credits

naroSEC rcourtman