CVE-2026-92860

CRITICAL 9.1

rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. The attack may be performed from remote. Upgrading the affected component is advised.

CWE	CWE-20
Vendor	rcourtman
Product	pulse
Published	Sep 17, 2026

Stay Ahead of the Next One

Get instant alerts for rcourtman pulse

Be the first to know when new critical vulnerabilities affecting rcourtman pulse are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

rcourtman / Pulse

6.0.0 6.0.1 6.0.2 6.0.3 6.0.4 6.1.0-rc.0 6.1.0-rc.1 6.1.0-rc.2 6.1.0-rc.3 6.1.0-rc.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/406309 vuldb.com: https://vuldb.com/vuln/406309/cti vuldb.com: https://vuldb.com/cve/CVE-2026-92860 vuldb.com: https://vuldb.com/submit/941807 github.com: https://github.com/rcourtman/Pulse/security/advisories/GHSA-rr3f-jjrr-3qxv github.com: https://github.com/rcourtman/Pulse/releases/tag/v6.1.0 github.com: https://github.com/rcourtman/Pulse/

Credits

🔍 wanyan (VulDB User)