Missing Authorization Vulnerability in Pulse by Pulse

CVE-2026-129428

What is CVE-2026-129428?

Pulse versions prior to 6.8.0 exhibit a critical missing authorization vulnerability within the /api/ai/approvals endpoints, enabling authenticated users with viewer-level access to manipulate approval requests. This flaw allows users to list pending requests, thereby exposing sensitive commands and targets, and potentially approving or denying requests from others. The consequence is a significant alteration of decision-making and audit states, leading to possible unauthorized actions within the system's processes.

References