CVE-2026-129428
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Nov 14, 2026
Vendor
unknown
Description
Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that allows authenticated viewer-level users to manage approval requests. Attackers can list pending requests to expose proposed commands and targets, and approve or deny other users' requests, altering decision and audit state.