CVE-2026-129428

Name of the Vulnerable Software and Affected Versions Pulse versions 5.0.17 through 6.7.9

Description An authorization flaw exists in the '/api/ai/approvals' endpoint. This issue allows authenticated users with viewer-level permissions to manage approval requests. An attacker can list pending requests to expose proposed commands and targets, as well as approve or deny requests made by other users, which alters the decision and audit state.

Recommendations Update Pulse to version 6.8.0 or later. Restrict access to the '/api/ai/approvals' endpoint for viewer-level users as a temporary mitigation.