CVE-2026-129428

Pulse versions 5.0.17 before 6.8.0 are vulnerable to a missing authorization flaw in the /api/ai/approvals endpoints. This vulnerability allows authenticated users with viewer-level privileges to manage approval requests, enabling them to list pending requests to expose proposed commands and targ...

CVE-2026-129428 Pulse 5.0.17 before 6.8.0 Missing Authorization via AI Assistant Approval API

Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that allows authenticated viewer-level users to manage approval requests. Attackers can list pending requests to expose proposed commands and targets, and approve or deny other users'...